diff --git a/terraform/.header.md b/terraform/.header.md deleted file mode 100644 index 1fe5a09ddaba..000000000000 --- a/terraform/.header.md +++ /dev/null @@ -1,48 +0,0 @@ -This module provides a basic Fleet setup. This assumes that you bring nothing to the installation. -If you want to bring your own VPC/database/cache nodes/ECS cluster, then use one of the submodules provided. - -To quickly list all available module versions you can run: -```shell -git tag |grep '^tf' -``` - -The following is the module layout, so you can navigate to the module that you want: - -* Root module (use this to get a Fleet instance ASAP with minimal setup) - * BYO-VPC (use this if you want to install Fleet inside an existing VPC) - * BYO-database (use this if you want to use an existing database and cache node) - * BYO-ECS (use this if you want to bring your own everything but Fleet ECS services) - -# Migrating from existing Dogfood code -The below code describes how to migrate from existing Dogfood code - -```hcl -moved { - from = module.vpc - to = module.main.module.vpc -} - -moved { - from = module.aurora_mysql - to = module.main.module.byo-vpc.module.rds -} - -moved { - from = aws_elasticache_replication_group.default - to = module.main.module.byo-vpc.module.redis.aws_elasticache_replication_group.default -} -``` - -This focuses on the resources that are "heavy" or store data. Note that the ALB cannot be moved like this because Dogfood uses the `aws_alb` resource and the module uses the `aws_lb` resource. The resources are aliases of eachother, but Terraform can't recognize that. - -# How to improve this module -If this module somehow doesn't fit your needs, feel free to contact us by -opening a ticket, or contacting your contact at Fleet. Our goal is to make this module -fit all needs within AWS, so we will try to find a solution so that this module fits your needs. - -If you want to make the changes yourself, simply make a PR into main with your additions. -We would ask that you make sure that variables are defined as null if there is -no default that makes sense and that variable changes are reflected all the way up the stack. - -# How to update this readme -Edit .header.md and run `terraform-docs markdown . > README.md` diff --git a/terraform/README.md b/terraform/README.md index 243586d48509..5291012763e4 100644 --- a/terraform/README.md +++ b/terraform/README.md @@ -1,89 +1,13 @@ -This module provides a basic Fleet setup. This assumes that you bring nothing to the installation. -If you want to bring your own VPC/database/cache nodes/ECS cluster, then use one of the submodules provided. +# Moved -To quickly list all available module versions you can run: -```shell -git tag |grep '^tf' -``` - -The following is the module layout, so you can navigate to the module that you want: - -* Root module (use this to get a Fleet instance ASAP with minimal setup) - * BYO-VPC (use this if you want to install Fleet inside an existing VPC) - * BYO-database (use this if you want to use an existing database and cache node) - * BYO-ECS (use this if you want to bring your own everything but Fleet ECS services) +The Fleet Terraform Modules have moved to [here](https://github.com/fleetdm/fleet-terraform). -# Migrating from existing Dogfood code -The below code describes how to migrate from existing Dogfood code +The tags for all legacy versions of modules are still available by their named versions. -```hcl -moved { - from = module.vpc - to = module.main.module.vpc -} +The repo can be searched for these by via the following command: -moved { - from = module.aurora_mysql - to = module.main.module.byo-vpc.module.rds -} - -moved { - from = aws_elasticache_replication_group.default - to = module.main.module.byo-vpc.module.redis.aws_elasticache_replication_group.default -} +``` +git tag | grep tf-mod ``` -This focuses on the resources that are "heavy" or store data. Note that the ALB cannot be moved like this because Dogfood uses the `aws_alb` resource and the module uses the `aws_lb` resource. The resources are aliases of eachother, but Terraform can't recognize that. - -# How to improve this module -If this module somehow doesn't fit your needs, feel free to contact us by -opening a ticket, or contacting your contact at Fleet. Our goal is to make this module -fit all needs within AWS, so we will try to find a solution so that this module fits your needs. - -If you want to make the changes yourself, simply make a PR into main with your additions. -We would ask that you make sure that variables are defined as null if there is -no default that makes sense and that variable changes are reflected all the way up the stack. - -# How to update this readme -Edit .header.md and run `terraform-docs markdown . > README.md` - -## Requirements - -| Name | Version | -|------|---------| -| [terraform](#requirement\_terraform) | >= 1.3.8 | - -## Providers - -No providers. - -## Modules - -| Name | Source | Version | -|------|--------|---------| -| [byo-vpc](#module\_byo-vpc) | ./byo-vpc | n/a | -| [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 5.1.2 | - -## Resources - -No resources. - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [alb\_config](#input\_alb\_config) | n/a | 
object({
    name                 = optional(string, "fleet")
    security_groups      = optional(list(string), [])
    access_logs          = optional(map(string), {})
    allowed_cidrs        = optional(list(string), ["0.0.0.0/0"])
    allowed_ipv6_cidrs   = optional(list(string), ["::/0"])
    egress_cidrs         = optional(list(string), ["0.0.0.0/0"])
    egress_ipv6_cidrs    = optional(list(string), ["::/0"])
    extra_target_groups  = optional(any, [])
    https_listener_rules = optional(any, [])
    tls_policy           = optional(string, "ELBSecurityPolicy-TLS-1-2-2017-01")
    idle_timeout         = optional(number, 905)
  })
| `{}` | no | -| [certificate\_arn](#input\_certificate\_arn) | n/a | `string` | n/a | yes | -| [ecs\_cluster](#input\_ecs\_cluster) | The config for the terraform-aws-modules/ecs/aws module | 
object({
    autoscaling_capacity_providers = optional(any, {})
    cluster_configuration = optional(any, {
      execute_command_configuration = {
        logging = "OVERRIDE"
        log_configuration = {
          cloud_watch_log_group_name = "/aws/ecs/aws-ec2"
        }
      }
    })
    cluster_name = optional(string, "fleet")
    cluster_settings = optional(map(string), {
      "name" : "containerInsights",
      "value" : "enabled",
    })
    create                                = optional(bool, true)
    default_capacity_provider_use_fargate = optional(bool, true)
    fargate_capacity_providers = optional(any, {
      FARGATE = {
        default_capacity_provider_strategy = {
          weight = 100
        }
      }
      FARGATE_SPOT = {
        default_capacity_provider_strategy = {
          weight = 0
        }
      }
    })
    tags = optional(map(string))
  })
| 
{
  "autoscaling_capacity_providers": {},
  "cluster_configuration": {
    "execute_command_configuration": {
      "log_configuration": {
        "cloud_watch_log_group_name": "/aws/ecs/aws-ec2"
      },
      "logging": "OVERRIDE"
    }
  },
  "cluster_name": "fleet",
  "cluster_settings": {
    "name": "containerInsights",
    "value": "enabled"
  },
  "create": true,
  "default_capacity_provider_use_fargate": true,
  "fargate_capacity_providers": {
    "FARGATE": {
      "default_capacity_provider_strategy": {
        "weight": 100
      }
    },
    "FARGATE_SPOT": {
      "default_capacity_provider_strategy": {
        "weight": 0
      }
    }
  },
  "tags": {}
}
| no | -| [fleet\_config](#input\_fleet\_config) | The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified. | 
object({
    task_mem                     = optional(number, null)
    task_cpu                     = optional(number, null)
    mem                          = optional(number, 4096)
    cpu                          = optional(number, 512)
    pid_mode                     = optional(string, null)
    image                        = optional(string, "fleetdm/fleet:v4.54.1")
    family                       = optional(string, "fleet")
    sidecars                     = optional(list(any), [])
    depends_on                   = optional(list(any), [])
    mount_points                 = optional(list(any), [])
    volumes                      = optional(list(any), [])
    extra_environment_variables  = optional(map(string), {})
    extra_iam_policies           = optional(list(string), [])
    extra_execution_iam_policies = optional(list(string), [])
    extra_secrets                = optional(map(string), {})
    security_group_name          = optional(string, "fleet")
    iam_role_arn                 = optional(string, null)
    repository_credentials       = optional(string, "")
    private_key_secret_name      = optional(string, "fleet-server-private-key")
    service = optional(object({
      name = optional(string, "fleet")
      }), {
      name = "fleet"
    })
    database = optional(object({
      password_secret_arn = string
      user                = string
      database            = string
      address             = string
      rr_address          = optional(string, null)
      }), {
      password_secret_arn = null
      user                = null
      database            = null
      address             = null
      rr_address          = null
    })
    redis = optional(object({
      address = string
      use_tls = optional(bool, true)
      }), {
      address = null
      use_tls = true
    })
    awslogs = optional(object({
      name      = optional(string, null)
      region    = optional(string, null)
      create    = optional(bool, true)
      prefix    = optional(string, "fleet")
      retention = optional(number, 5)
      }), {
      name      = null
      region    = null
      prefix    = "fleet"
      retention = 5
    })
    loadbalancer = optional(object({
      arn = string
      }), {
      arn = null
    })
    extra_load_balancers = optional(list(any), [])
    networking = optional(object({
      subnets         = optional(list(string), null)
      security_groups = optional(list(string), null)
      ingress_sources = optional(object({
        cidr_blocks      = optional(list(string), [])
        ipv6_cidr_blocks = optional(list(string), [])
        security_groups  = optional(list(string), [])
        prefix_list_ids  = optional(list(string), [])
        }), {
        cidr_blocks      = []
        ipv6_cidr_blocks = []
        security_groups  = []
        prefix_list_ids  = []
      })
      }), {
      subnets         = null
      security_groups = null
      ingress_sources = {
        cidr_blocks      = []
        ipv6_cidr_blocks = []
        security_groups  = []
        prefix_list_ids  = []
      }
    })
    autoscaling = optional(object({
      max_capacity                 = optional(number, 5)
      min_capacity                 = optional(number, 1)
      memory_tracking_target_value = optional(number, 80)
      cpu_tracking_target_value    = optional(number, 80)
      }), {
      max_capacity                 = 5
      min_capacity                 = 1
      memory_tracking_target_value = 80
      cpu_tracking_target_value    = 80
    })
    iam = optional(object({
      role = optional(object({
        name        = optional(string, "fleet-role")
        policy_name = optional(string, "fleet-iam-policy")
        }), {
        name        = "fleet-role"
        policy_name = "fleet-iam-policy"
      })
      execution = optional(object({
        name        = optional(string, "fleet-execution-role")
        policy_name = optional(string, "fleet-execution-role")
        }), {
        name        = "fleet-execution-role"
        policy_name = "fleet-iam-policy-execution"
      })
      }), {
      name = "fleetdm-execution-role"
    })
    software_installers = optional(object({
      create_bucket    = optional(bool, true)
      bucket_name      = optional(string, null)
      bucket_prefix    = optional(string, "fleet-software-installers-")
      s3_object_prefix = optional(string, "")
      }), {
      create_bucket    = true
      bucket_name      = null
      bucket_prefix    = "fleet-software-installers-"
      s3_object_prefix = ""
    })
  })
| 
{
  "autoscaling": {
    "cpu_tracking_target_value": 80,
    "max_capacity": 5,
    "memory_tracking_target_value": 80,
    "min_capacity": 1
  },
  "awslogs": {
    "create": true,
    "name": null,
    "prefix": "fleet",
    "region": null,
    "retention": 5
  },
  "cpu": 256,
  "database": {
    "address": null,
    "database": null,
    "password_secret_arn": null,
    "rr_address": null,
    "user": null
  },
  "depends_on": [],
  "extra_environment_variables": {},
  "extra_execution_iam_policies": [],
  "extra_iam_policies": [],
  "extra_load_balancers": [],
  "extra_secrets": {},
  "family": "fleet",
  "iam": {
    "execution": {
      "name": "fleet-execution-role",
      "policy_name": "fleet-iam-policy-execution"
    },
    "role": {
      "name": "fleet-role",
      "policy_name": "fleet-iam-policy"
    }
  },
  "iam_role_arn": null,
  "image": "fleetdm/fleet:v4.54.1",
  "loadbalancer": {
    "arn": null
  },
  "mem": 512,
  "mount_points": [],
  "networking": {
    "ingress_sources": {
      "cidr_blocks": [],
      "ipv6_cidr_blocks": [],
      "prefix_list_ids": [],
      "security_groups": []
    },
    "security_groups": null,
    "subnets": null
  },
  "pid_mode": null,
  "private_key_secret_name": "fleet-server-private-key",
  "redis": {
    "address": null,
    "use_tls": true
  },
  "repository_credentials": "",
  "security_group_name": "fleet",
  "security_groups": null,
  "service": {
    "name": "fleet"
  },
  "sidecars": [],
  "software_installers": {
    "bucket_name": null,
    "bucket_prefix": "fleet-software-installers-",
    "create_bucket": true,
    "s3_object_prefix": ""
  },
  "task_cpu": null,
  "task_mem": null,
  "volumes": []
}
| no | -| [migration\_config](#input\_migration\_config) | The configuration object for Fleet's migration task. | 
object({
    mem = number
    cpu = number
  })
| 
{
  "cpu": 1024,
  "mem": 2048
}
| no | -| [rds\_config](#input\_rds\_config) | The config for the terraform-aws-modules/rds-aurora/aws module | 
object({
    name                            = optional(string, "fleet")
    engine_version                  = optional(string, "8.0.mysql_aurora.3.07.1")
    instance_class                  = optional(string, "db.t4g.large")
    subnets                         = optional(list(string), [])
    allowed_security_groups         = optional(list(string), [])
    allowed_cidr_blocks             = optional(list(string), [])
    apply_immediately               = optional(bool, true)
    monitoring_interval             = optional(number, 10)
    db_parameter_group_name         = optional(string)
    db_parameters                   = optional(map(string), {})
    db_cluster_parameter_group_name = optional(string)
    db_cluster_parameters           = optional(map(string), {})
    enabled_cloudwatch_logs_exports = optional(list(string), [])
    master_username                 = optional(string, "fleet")
    snapshot_identifier             = optional(string)
    cluster_tags                    = optional(map(string), {})
  })
| 
{
  "allowed_cidr_blocks": [],
  "allowed_security_groups": [],
  "apply_immediately": true,
  "cluster_tags": {},
  "db_cluster_parameter_group_name": null,
  "db_cluster_parameters": {},
  "db_parameter_group_name": null,
  "db_parameters": {},
  "enabled_cloudwatch_logs_exports": [],
  "engine_version": "8.0.mysql_aurora.3.07.1",
  "instance_class": "db.t4g.large",
  "master_username": "fleet",
  "monitoring_interval": 10,
  "name": "fleet",
  "snapshot_identifier": null,
  "subnets": []
}
| no | -| [redis\_config](#input\_redis\_config) | n/a | 
object({
    name                          = optional(string, "fleet")
    replication_group_id          = optional(string)
    elasticache_subnet_group_name = optional(string)
    allowed_security_group_ids    = optional(list(string), [])
    subnets                       = optional(list(string))
    availability_zones            = optional(list(string))
    cluster_size                  = optional(number, 3)
    instance_type                 = optional(string, "cache.m5.large")
    apply_immediately             = optional(bool, true)
    automatic_failover_enabled    = optional(bool, false)
    engine_version                = optional(string, "6.x")
    family                        = optional(string, "redis6.x")
    at_rest_encryption_enabled    = optional(bool, true)
    transit_encryption_enabled    = optional(bool, true)
    parameter = optional(list(object({
      name  = string
      value = string
    })), [])
    log_delivery_configuration = optional(list(map(any)), [])
    tags                       = optional(map(string), {})
  })
| 
{
  "allowed_security_group_ids": [],
  "apply_immediately": true,
  "at_rest_encryption_enabled": true,
  "automatic_failover_enabled": false,
  "availability_zones": null,
  "cluster_size": 3,
  "elasticache_subnet_group_name": null,
  "engine_version": "6.x",
  "family": "redis6.x",
  "instance_type": "cache.m5.large",
  "log_delivery_configuration": [],
  "name": "fleet",
  "parameter": [],
  "replication_group_id": null,
  "subnets": null,
  "tags": {},
  "transit_encryption_enabled": true
}
| no | -| [vpc](#input\_vpc) | n/a | 
object({
    name                = optional(string, "fleet")
    cidr                = optional(string, "10.10.0.0/16")
    azs                 = optional(list(string), ["us-east-2a", "us-east-2b", "us-east-2c"])
    private_subnets     = optional(list(string), ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"])
    public_subnets      = optional(list(string), ["10.10.11.0/24", "10.10.12.0/24", "10.10.13.0/24"])
    database_subnets    = optional(list(string), ["10.10.21.0/24", "10.10.22.0/24", "10.10.23.0/24"])
    elasticache_subnets = optional(list(string), ["10.10.31.0/24", "10.10.32.0/24", "10.10.33.0/24"])

    create_database_subnet_group              = optional(bool, false)
    create_database_subnet_route_table        = optional(bool, true)
    create_elasticache_subnet_group           = optional(bool, true)
    create_elasticache_subnet_route_table     = optional(bool, true)
    enable_vpn_gateway                        = optional(bool, false)
    one_nat_gateway_per_az                    = optional(bool, false)
    single_nat_gateway                        = optional(bool, true)
    enable_nat_gateway                        = optional(bool, true)
    enable_dns_hostnames                      = optional(bool, false)
    enable_dns_support                        = optional(bool, true)
    enable_flow_log                           = optional(bool, false)
    create_flow_log_cloudwatch_log_group      = optional(bool, false)
    create_flow_log_cloudwatch_iam_role       = optional(bool, false)
    flow_log_max_aggregation_interval         = optional(number, 600)
    flow_log_cloudwatch_log_group_name_prefix = optional(string, "/aws/vpc-flow-log/")
    flow_log_cloudwatch_log_group_name_suffix = optional(string, "")
    vpc_flow_log_tags                         = optional(map(string), {})
  })
| 
{
  "azs": [
    "us-east-2a",
    "us-east-2b",
    "us-east-2c"
  ],
  "cidr": "10.10.0.0/16",
  "create_database_subnet_group": false,
  "create_database_subnet_route_table": true,
  "create_elasticache_subnet_group": true,
  "create_elasticache_subnet_route_table": true,
  "create_flow_log_cloudwatch_iam_role": false,
  "create_flow_log_cloudwatch_log_group": false,
  "database_subnets": [
    "10.10.21.0/24",
    "10.10.22.0/24",
    "10.10.23.0/24"
  ],
  "elasticache_subnets": [
    "10.10.31.0/24",
    "10.10.32.0/24",
    "10.10.33.0/24"
  ],
  "enable_dns_hostnames": false,
  "enable_dns_support": true,
  "enable_flow_log": false,
  "enable_nat_gateway": true,
  "enable_vpn_gateway": false,
  "flow_log_cloudwatch_log_group_name_prefix": "/aws/vpc-flow-log/",
  "flow_log_cloudwatch_log_group_name_suffix": "",
  "flow_log_max_aggregation_interval": 600,
  "name": "fleet",
  "one_nat_gateway_per_az": false,
  "private_subnets": [
    "10.10.1.0/24",
    "10.10.2.0/24",
    "10.10.3.0/24"
  ],
  "public_subnets": [
    "10.10.11.0/24",
    "10.10.12.0/24",
    "10.10.13.0/24"
  ],
  "single_nat_gateway": true,
  "vpc_flow_log_tags": {}
}
| no | - -## Outputs - -| Name | Description | -|------|-------------| -| [byo-vpc](#output\_byo-vpc) | n/a | -| [vpc](#output\_vpc) | n/a | +All names and versions will be visible. diff --git a/terraform/addons/README.md b/terraform/addons/README.md deleted file mode 100644 index c6b805fd621f..000000000000 --- a/terraform/addons/README.md +++ /dev/null @@ -1,2 +0,0 @@ -This directory contains addons to the core Fleet module that add additional features such as logging destinations, or other features that some customers might not want. -These can be included and used as desired. diff --git a/terraform/addons/byo-file-carving/carving/.header.md b/terraform/addons/byo-file-carving/carving/.header.md deleted file mode 100644 index c3aec75907c6..000000000000 --- a/terraform/addons/byo-file-carving/carving/.header.md +++ /dev/null @@ -1,16 +0,0 @@ -# S3 File Carving backend - -This module creates the necessary IAM role for Fleet to attach when it's running in server mode. - -It also exports the `fleet_extra_environment_variables` to configure Fleet server to use S3 as the backing carve results store. - -Usage typically looks like: - -```terraform -fleet_config = { - extra_environment_variables = merge( - local.extra_environment_variables, - module.carving.fleet_extra_environment_variables - ) -} -``` \ No newline at end of file diff --git a/terraform/addons/byo-file-carving/carving/.terraform-docs.yml b/terraform/addons/byo-file-carving/carving/.terraform-docs.yml deleted file mode 100644 index 1d139ddb401d..000000000000 --- a/terraform/addons/byo-file-carving/carving/.terraform-docs.yml +++ /dev/null @@ -1 +0,0 @@ -header-from: .header.md diff --git a/terraform/addons/byo-file-carving/carving/README.md b/terraform/addons/byo-file-carving/carving/README.md deleted file mode 100644 index 8958b8469bdc..000000000000 --- a/terraform/addons/byo-file-carving/carving/README.md +++ /dev/null @@ -1,54 +0,0 @@ -# S3 File Carving backend - -This module creates the necessary IAM role for Fleet to attach when it's running in server mode. - -It also exports the `fleet_extra_environment_variables` to configure Fleet server to use S3 as the backing carve results store. - -Usage typically looks like: - -```terraform -fleet_config = { - extra_environment_variables = merge( - local.extra_environment_variables, - module.carving.fleet_extra_environment_variables - ) -} -``` - -## Requirements - -No requirements. - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | n/a | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [aws_iam_policy.fleet-assume-role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | -| [aws_iam_policy_document.fleet-assume-role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [iam\_role\_arn](#input\_iam\_role\_arn) | IAM Role ARN to assume into for file carving uploads to S3 | `string` | n/a | yes | -| [s3\_bucket\_name](#input\_s3\_bucket\_name) | The S3 bucket for carve results to be written to | `string` | n/a | yes | -| [s3\_bucket\_region](#input\_s3\_bucket\_region) | The S3 bucket region | `string` | n/a | yes | -| [s3\_carve\_prefix](#input\_s3\_carve\_prefix) | The S3 object prefix to use when storing carve results | `string` | `""` | no | -| [sts\_external\_id](#input\_sts\_external\_id) | Optional unique identifier that can be used by the principal assuming the role to assert its identity. | `string` | `""` | no | - -## Outputs - -| Name | Description | -|------|-------------| -| [fleet\_extra\_environment\_variables](#output\_fleet\_extra\_environment\_variables) | n/a | -| [fleet\_extra\_iam\_policies](#output\_fleet\_extra\_iam\_policies) | n/a | diff --git a/terraform/addons/byo-file-carving/carving/iam.tf b/terraform/addons/byo-file-carving/carving/iam.tf deleted file mode 100644 index d394ab86ae6a..000000000000 --- a/terraform/addons/byo-file-carving/carving/iam.tf +++ /dev/null @@ -1,11 +0,0 @@ -data "aws_iam_policy_document" "fleet-assume-role" { - statement { - effect = "Allow" - actions = ["sts:AssumeRole"] - resources = [var.iam_role_arn] - } -} - -resource "aws_iam_policy" "fleet-assume-role" { - policy = data.aws_iam_policy_document.fleet-assume-role.json -} \ No newline at end of file diff --git a/terraform/addons/byo-file-carving/carving/outputs.tf b/terraform/addons/byo-file-carving/carving/outputs.tf deleted file mode 100644 index 3622e7dfd693..000000000000 --- a/terraform/addons/byo-file-carving/carving/outputs.tf +++ /dev/null @@ -1,15 +0,0 @@ -output "fleet_extra_environment_variables" { - value = { - FLEET_S3_CARVES_STS_ASSUME_ROLE_ARN = var.iam_role_arn - FLEET_S3_CARVES_STS_EXTERNAL_ID = var.sts_external_id - FLEET_S3_CARVES_BUCKET = var.s3_bucket_name - FLEET_S3_CARVES_REGION = var.s3_bucket_region - FLEET_S3_CARVES_PREFIX = var.s3_carve_prefix - } -} - -output "fleet_extra_iam_policies" { - value = [ - aws_iam_policy.fleet-assume-role.arn - ] -} diff --git a/terraform/addons/byo-file-carving/carving/variables.tf b/terraform/addons/byo-file-carving/carving/variables.tf deleted file mode 100644 index 054e72fe7bec..000000000000 --- a/terraform/addons/byo-file-carving/carving/variables.tf +++ /dev/null @@ -1,26 +0,0 @@ -variable "iam_role_arn" { - type = string - description = "IAM Role ARN to assume into for file carving uploads to S3" -} - -variable "sts_external_id" { - type = string - description = "Optional unique identifier that can be used by the principal assuming the role to assert its identity." - default = "" -} - -variable "s3_bucket_name" { - type = string - description = "The S3 bucket for carve results to be written to" -} - -variable "s3_bucket_region" { - type = string - description = "The S3 bucket region" -} - -variable "s3_carve_prefix" { - type = string - description = "The S3 object prefix to use when storing carve results" - default = "" -} \ No newline at end of file diff --git a/terraform/addons/byo-file-carving/target-account/.header.md b/terraform/addons/byo-file-carving/target-account/.header.md deleted file mode 100644 index 29dd41664bcd..000000000000 --- a/terraform/addons/byo-file-carving/target-account/.header.md +++ /dev/null @@ -1,25 +0,0 @@ -# AWS S3 File Carving Infrastructure - -This Terraform configuration sets up the necessary resources for a secure file carving infrastructure in AWS. File carving is a significant capability for security and forensic analysis, enabling organizations to extract and analyze the content of files from their endpoints. - -## Overview of Resources - -The resources configured in this Terraform script include: - -- **AWS Key Management Service (KMS) Key**: A customer-managed KMS key is created to provide server-side encryption for the S3 bucket where carved files will be stored. The policy attached to this key grants full KMS permissions to the AWS account's root user. - -- **Amazon S3 Bucket**: An S3 bucket is provisioned to act as the central repository for storing the results of the file carving process. The bucket is named according to the provided variable `var.bucket_name`. - -- **S3 Bucket Server-Side Encryption Configuration**: This resource configures server-side encryption for the S3 bucket, specifying the custom-created KMS key as the master key for encrypting objects stored in the bucket. - -- **IAM Policy**: An IAM policy is created to enable specific access to the S3 bucket. This policy is defined via a detailed policy document which grants permissions to perform various actions essential for managing the file carving process. Actions include object retrieval (`GetObject*`), object creation (`PutObject*`), listing the bucket (`ListBucket*`), and managing multipart uploads. It also allows for certain KMS actions necessary for encrypting and decrypting the stored data. - -- **IAM Role**: An IAM role (`aws_iam_role`) is provisioned with a trust relationship policy that permits an external entity, specified by `var.fleet_iam_role_arn`, to assume the role. This allows secure access to the S3 bucket and KMS key based on assuming roles across AWS accounts or services. - -- **IAM Role Policy Attachment**: This attachment links the previously created IAM policy to the IAM role, ensuring that the permissions are in effect when the role is assumed by the external entity. - -## Usage - -To use this Terraform configuration, ensure that you have Terraform installed and configured with the necessary AWS credentials. You should define the `bucket_name` and `fleet_iam_role_arn` variables according to your organization's requirements before applying the Terraform plan. - -This infrastructure enables secure storage and access for file carving results, facilitating forensic analysis and the capability to respond to security incidents effectively. diff --git a/terraform/addons/byo-file-carving/target-account/.terraform-docs.yml b/terraform/addons/byo-file-carving/target-account/.terraform-docs.yml deleted file mode 100644 index 1d139ddb401d..000000000000 --- a/terraform/addons/byo-file-carving/target-account/.terraform-docs.yml +++ /dev/null @@ -1 +0,0 @@ -header-from: .header.md diff --git a/terraform/addons/byo-file-carving/target-account/README.md b/terraform/addons/byo-file-carving/target-account/README.md deleted file mode 100644 index 456dfd077e72..000000000000 --- a/terraform/addons/byo-file-carving/target-account/README.md +++ /dev/null @@ -1,71 +0,0 @@ -# AWS S3 File Carving Infrastructure - -This Terraform configuration sets up the necessary resources for a secure file carving infrastructure in AWS. File carving is a significant capability for security and forensic analysis, enabling organizations to extract and analyze the content of files from their endpoints. - -## Overview of Resources - -The resources configured in this Terraform script include: - -- **AWS Key Management Service (KMS) Key**: A customer-managed KMS key is created to provide server-side encryption for the S3 bucket where carved files will be stored. The policy attached to this key grants full KMS permissions to the AWS account's root user. - -- **Amazon S3 Bucket**: An S3 bucket is provisioned to act as the central repository for storing the results of the file carving process. The bucket is named according to the provided variable `var.bucket_name`. - -- **S3 Bucket Server-Side Encryption Configuration**: This resource configures server-side encryption for the S3 bucket, specifying the custom-created KMS key as the master key for encrypting objects stored in the bucket. - -- **IAM Policy**: An IAM policy is created to enable specific access to the S3 bucket. This policy is defined via a detailed policy document which grants permissions to perform various actions essential for managing the file carving process. Actions include object retrieval (`GetObject*`), object creation (`PutObject*`), listing the bucket (`ListBucket*`), and managing multipart uploads. It also allows for certain KMS actions necessary for encrypting and decrypting the stored data. - -- **IAM Role**: An IAM role (`aws_iam_role`) is provisioned with a trust relationship policy that permits an external entity, specified by `var.fleet_iam_role_arn`, to assume the role. This allows secure access to the S3 bucket and KMS key based on assuming roles across AWS accounts or services. - -- **IAM Role Policy Attachment**: This attachment links the previously created IAM policy to the IAM role, ensuring that the permissions are in effect when the role is assumed by the external entity. - -## Usage - -To use this Terraform configuration, ensure that you have Terraform installed and configured with the necessary AWS credentials. You should define the `bucket_name` and `fleet_iam_role_arn` variables according to your organization's requirements before applying the Terraform plan. - -This infrastructure enables secure storage and access for file carving results, facilitating forensic analysis and the capability to respond to security incidents effectively. - -## Requirements - -No requirements. - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | n/a | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [aws_iam_policy.s3_access_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | -| [aws_iam_role.carve_s3_delegation_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | -| [aws_iam_role_policy_attachment.s3_access_attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | -| [aws_kms_key.s3_encryption_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource | -| [aws_s3_bucket.carve_results_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource | -| [aws_s3_bucket_public_access_block.carve_results](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource | -| [aws_s3_bucket_server_side_encryption_configuration.sse](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource | -| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | -| [aws_iam_policy_document.assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.kms_key_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.s3_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [bucket\_name](#input\_bucket\_name) | The name of the osquery carve results bucket | `string` | n/a | yes | -| [fleet\_iam\_role\_arn](#input\_fleet\_iam\_role\_arn) | The IAM role ARN of the Fleet service | `string` | n/a | yes | -| [sts\_external\_id](#input\_sts\_external\_id) | Optional unique identifier that can be used by the principal assuming the role to assert its identity. | `string` | `""` | no | - -## Outputs - -| Name | Description | -|------|-------------| -| [iam\_role\_arn](#output\_iam\_role\_arn) | n/a | -| [s3\_bucket\_name](#output\_s3\_bucket\_name) | n/a | -| [s3\_bucket\_region](#output\_s3\_bucket\_region) | n/a | diff --git a/terraform/addons/byo-file-carving/target-account/outputs.tf b/terraform/addons/byo-file-carving/target-account/outputs.tf deleted file mode 100644 index 870d749f3c46..000000000000 --- a/terraform/addons/byo-file-carving/target-account/outputs.tf +++ /dev/null @@ -1,11 +0,0 @@ -output "iam_role_arn" { - value = aws_iam_role.carve_s3_delegation_role.arn -} - -output "s3_bucket_name" { - value = aws_s3_bucket.carve_results_bucket.id -} - -output "s3_bucket_region" { - value = aws_s3_bucket.carve_results_bucket.region -} \ No newline at end of file diff --git a/terraform/addons/byo-file-carving/target-account/s3.tf b/terraform/addons/byo-file-carving/target-account/s3.tf deleted file mode 100644 index a3e4dd53aa1d..000000000000 --- a/terraform/addons/byo-file-carving/target-account/s3.tf +++ /dev/null @@ -1,112 +0,0 @@ -data "aws_caller_identity" "current" {} - -# IAM policy document for the KMS key -data "aws_iam_policy_document" "kms_key_policy" { - statement { - sid = "Enable IAM User Permissions" - actions = ["kms:*"] - resources = ["*"] - principals { - type = "AWS" - identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"] - } - } -} - -# Create a KMS key for encrypting the S3 bucket -resource "aws_kms_key" "s3_encryption_key" { - description = "KMS key for S3 bucket encryption" - is_enabled = true - policy = data.aws_iam_policy_document.kms_key_policy.json -} - -# Create an S3 bucket with server-side encryption using the customer-managed key -resource "aws_s3_bucket" "carve_results_bucket" { - bucket = var.bucket_name -} - -resource "aws_s3_bucket_public_access_block" "carve_results" { - bucket = aws_s3_bucket.carve_results_bucket.id - - block_public_acls = true - block_public_policy = true - ignore_public_acls = true - restrict_public_buckets = true -} - -resource "aws_s3_bucket_server_side_encryption_configuration" "sse" { - bucket = aws_s3_bucket.carve_results_bucket.id - rule { - apply_server_side_encryption_by_default { - sse_algorithm = "aws:kms" - kms_master_key_id = aws_kms_key.s3_encryption_key.key_id - } - } -} - -# Create an IAM policy which allows the necessary S3 actions -resource "aws_iam_policy" "s3_access_policy" { - name = "s3_access_policy" - policy = data.aws_iam_policy_document.s3_policy.json -} - -# IAM policy document -data "aws_iam_policy_document" "s3_policy" { - statement { - actions = [ - "s3:GetObject*", - "s3:PutObject*", - "s3:ListBucket*", - "s3:ListMultipartUploadParts*", - "s3:DeleteObject", - "s3:CreateMultipartUpload", - "s3:AbortMultipartUpload", - "s3:ListMultipartUploadParts", - "s3:GetBucketLocation" - ] - - resources = [ - aws_s3_bucket.carve_results_bucket.arn, - "${aws_s3_bucket.carve_results_bucket.arn}/*" - ] - } - - statement { - effect = "Allow" - actions = [ - "kms:Decrypt", - "kms:GenerateDataKey", - "kms:Encrypt" - ] - resources = [aws_kms_key.s3_encryption_key.arn] - } -} - -data "aws_iam_policy_document" "assume_role" { - statement { - effect = "Allow" - actions = ["sts:AssumeRole"] - principals { - identifiers = [var.fleet_iam_role_arn] - type = "AWS" - } - dynamic "condition" { - for_each = length(var.sts_external_id) > 0 ? [1] : [] - content { - test = "StringEquals" - variable = "sts:ExternalId" - values = [var.sts_external_id] - } - } - } -} - -resource "aws_iam_role" "carve_s3_delegation_role" { - assume_role_policy = data.aws_iam_policy_document.assume_role.json -} - -# Attach the policy to the role -resource "aws_iam_role_policy_attachment" "s3_access_attachment" { - role = aws_iam_role.carve_s3_delegation_role.name - policy_arn = aws_iam_policy.s3_access_policy.arn -} diff --git a/terraform/addons/byo-file-carving/target-account/variables.tf b/terraform/addons/byo-file-carving/target-account/variables.tf deleted file mode 100644 index 91c716b7daba..000000000000 --- a/terraform/addons/byo-file-carving/target-account/variables.tf +++ /dev/null @@ -1,15 +0,0 @@ -variable "bucket_name" { - type = string - description = "The name of the osquery carve results bucket" -} - -variable "fleet_iam_role_arn" { - type = string - description = "The IAM role ARN of the Fleet service" -} - -variable "sts_external_id" { - type = string - description = "Optional unique identifier that can be used by the principal assuming the role to assert its identity." - default = "" -} \ No newline at end of file diff --git a/terraform/addons/byo-firehose-logging-destination/.header.md b/terraform/addons/byo-firehose-logging-destination/.header.md deleted file mode 100644 index cd409454e323..000000000000 --- a/terraform/addons/byo-firehose-logging-destination/.header.md +++ /dev/null @@ -1,6 +0,0 @@ -# Logging Destination: Firehose -This addon provides a Kinesis Firehose logging destination for Fleet. - -First apply the `target-account` module which will provision the necessary bucket, KMS key, and policies. - -Then apply the `firehose` module with the required variables. diff --git a/terraform/addons/byo-firehose-logging-destination/firehose/README.md b/terraform/addons/byo-firehose-logging-destination/firehose/README.md deleted file mode 100644 index 49bf993112a8..000000000000 --- a/terraform/addons/byo-firehose-logging-destination/firehose/README.md +++ /dev/null @@ -1,41 +0,0 @@ -## Requirements - -| Name | Version | -|------|---------| -| [terraform](#requirement\_terraform) | >= 1.3.7 | -| [aws](#requirement\_aws) | >= 4.52.0 | - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | >= 4.52.0 | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [aws_iam_policy.fleet-assume-role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | -| [aws_iam_policy_document.fleet-assume-role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [firehose\_audit\_name](#input\_firehose\_audit\_name) | name of the firehose delivery stream for fleet audit logs | `string` | n/a | yes | -| [firehose\_results\_name](#input\_firehose\_results\_name) | name of the firehose delivery stream for osquery results logs | `string` | n/a | yes | -| [firehose\_status\_name](#input\_firehose\_status\_name) | name of the firehose delivery stream for osquery status logs | `string` | n/a | yes | -| [iam\_role\_arn](#input\_iam\_role\_arn) | IAM Role ARN to use for Firehose destination logging | `string` | n/a | yes | -| [region](#input\_region) | region the target firehose delivery stream is in | `string` | n/a | yes | -| [sts\_external\_id](#input\_sts\_external\_id) | Optional unique identifier that can be used by the principal assuming the role to assert its identity. | `string` | `""` | no | - -## Outputs - -| Name | Description | -|------|-------------| -| [fleet\_extra\_environment\_variables](#output\_fleet\_extra\_environment\_variables) | n/a | -| [fleet\_extra\_iam\_policies](#output\_fleet\_extra\_iam\_policies) | n/a | diff --git a/terraform/addons/byo-firehose-logging-destination/firehose/iam.tf b/terraform/addons/byo-firehose-logging-destination/firehose/iam.tf deleted file mode 100644 index d394ab86ae6a..000000000000 --- a/terraform/addons/byo-firehose-logging-destination/firehose/iam.tf +++ /dev/null @@ -1,11 +0,0 @@ -data "aws_iam_policy_document" "fleet-assume-role" { - statement { - effect = "Allow" - actions = ["sts:AssumeRole"] - resources = [var.iam_role_arn] - } -} - -resource "aws_iam_policy" "fleet-assume-role" { - policy = data.aws_iam_policy_document.fleet-assume-role.json -} \ No newline at end of file diff --git a/terraform/addons/byo-firehose-logging-destination/firehose/outputs.tf b/terraform/addons/byo-firehose-logging-destination/firehose/outputs.tf deleted file mode 100644 index 506c48359b04..000000000000 --- a/terraform/addons/byo-firehose-logging-destination/firehose/outputs.tf +++ /dev/null @@ -1,20 +0,0 @@ -output "fleet_extra_environment_variables" { - value = { - FLEET_FIREHOSE_STATUS_STREAM = var.firehose_status_name - FLEET_FIREHOSE_RESULT_STREAM = var.firehose_results_name - FLEET_FIREHOSE_AUDIT_STREAM = var.firehose_audit_name - FLEET_FIREHOSE_STS_ASSUME_ROLE_ARN = var.iam_role_arn - FLEET_FIREHOSE_STS_EXTERNAL_ID = var.sts_external_id - FLEET_FIREHOSE_REGION = var.region - FLEET_OSQUERY_STATUS_LOG_PLUGIN = length(var.firehose_status_name) > 0 ? "firehose" : "" - FLEET_OSQUERY_RESULT_LOG_PLUGIN = length(var.firehose_results_name) > 0 ? "firehose" : "" - FLEET_ACTIVITY_AUDIT_LOG_PLUGIN = length(var.firehose_audit_name) > 0 ? "firehose" : "" - FLEET_ACTIVITY_ENABLE_AUDIT_LOG = length(var.firehose_audit_name) > 0 ? "true" : "false" - } -} - -output "fleet_extra_iam_policies" { - value = [ - aws_iam_policy.fleet-assume-role.arn - ] -} diff --git a/terraform/addons/byo-firehose-logging-destination/firehose/variables.tf b/terraform/addons/byo-firehose-logging-destination/firehose/variables.tf deleted file mode 100644 index 50bc040469a5..000000000000 --- a/terraform/addons/byo-firehose-logging-destination/firehose/variables.tf +++ /dev/null @@ -1,30 +0,0 @@ -variable "iam_role_arn" { - type = string - description = "IAM Role ARN to use for Firehose destination logging" -} - -variable "firehose_results_name" { - type = string - description = "name of the firehose delivery stream for osquery results logs" -} - -variable "firehose_status_name" { - type = string - description = "name of the firehose delivery stream for osquery status logs" -} - -variable "firehose_audit_name" { - type = string - description = "name of the firehose delivery stream for fleet audit logs" -} - -variable "region" { - type = string - description = "region the target firehose delivery stream is in" -} - -variable "sts_external_id" { - type = string - description = "Optional unique identifier that can be used by the principal assuming the role to assert its identity." - default = "" -} diff --git a/terraform/addons/byo-firehose-logging-destination/firehose/version.tf b/terraform/addons/byo-firehose-logging-destination/firehose/version.tf deleted file mode 100644 index 00143c571d72..000000000000 --- a/terraform/addons/byo-firehose-logging-destination/firehose/version.tf +++ /dev/null @@ -1,10 +0,0 @@ -terraform { - required_version = ">= 1.3.7" - - required_providers { - aws = { - source = "hashicorp/aws" - version = ">= 4.52.0" - } - } -} \ No newline at end of file diff --git a/terraform/addons/byo-firehose-logging-destination/target-account/.header.md b/terraform/addons/byo-firehose-logging-destination/target-account/.header.md deleted file mode 100644 index e361e1aa6233..000000000000 --- a/terraform/addons/byo-firehose-logging-destination/target-account/.header.md +++ /dev/null @@ -1,22 +0,0 @@ -# Firehose Logging Destination Setup - -In this Terraform code, we are defining an IAM Role named `fleet_role` in our AWS Account, that will be assumed by the Fleet application we are hosting. We are only allowing this specific IAM Role (identified by its ARN) to perform certain actions on the Firehose service, such as `DescribeDeliveryStream`, `PutRecord`, and `PutRecordBatch`. - -The reason we need a local IAM role in your account is so that we can assume role into it, and you have full control over the permissions it has. The associated IAM policy in the same file specifies the minimum allowed permissions. - -The Firehose service is KMS encrypted, so the IAM Role we assume into needs permission to the KMS key that is being used to encrypt the data going into Firehose. Additionally, if the data is being delivered to S3, it will also be encrypted with KMS using the AWS S3 KMS key that is managed by AWS. This is because only customer managed keys can be shared across accounts, and the Firehose delivery stream is actually the one writing to S3. - -This code sets up a secure and controlled environment for the Fleet application to perform its necessary actions on the Firehose service within your AWS Account. - -If you wanted to make changes to the individual files to fit your environment, feel free. However, it's recommended to use a module like the example below for simplicity. - -``` -module "firehose_logging" { - source = "github.com/fleetdm/fleet//terraform/addons/byo-firehose-logging-destination/target-account" - - # Variables - osquery_logging_destination_bucket_name = {your-desired-bucket-prefix} - fleet_iam_role_arn = {supplied by Fleet} - sts_external_id = {if using} -} -``` diff --git a/terraform/addons/byo-firehose-logging-destination/target-account/.terraform-docs.yml b/terraform/addons/byo-firehose-logging-destination/target-account/.terraform-docs.yml deleted file mode 100644 index 1d139ddb401d..000000000000 --- a/terraform/addons/byo-firehose-logging-destination/target-account/.terraform-docs.yml +++ /dev/null @@ -1 +0,0 @@ -header-from: .header.md diff --git a/terraform/addons/byo-firehose-logging-destination/target-account/README.md b/terraform/addons/byo-firehose-logging-destination/target-account/README.md deleted file mode 100644 index f378e24fafbf..000000000000 --- a/terraform/addons/byo-firehose-logging-destination/target-account/README.md +++ /dev/null @@ -1,80 +0,0 @@ -# Firehose Logging Destination Setup - -In this Terraform code, we are defining an IAM Role named `fleet_role` in our AWS Account, that will be assumed by the Fleet application we are hosting. We are only allowing this specific IAM Role (identified by its ARN) to perform certain actions on the Firehose service, such as `DescribeDeliveryStream`, `PutRecord`, and `PutRecordBatch`. - -The reason we need a local IAM role in your account is so that we can assume role into it, and you have full control over the permissions it has. The associated IAM policy in the same file specifies the minimum allowed permissions. - -The Firehose service is KMS encrypted, so the IAM Role we assume into needs permission to the KMS key that is being used to encrypt the data going into Firehose. Additionally, if the data is being delivered to S3, it will also be encrypted with KMS using the AWS S3 KMS key that is managed by AWS. This is because only customer managed keys can be shared across accounts, and the Firehose delivery stream is actually the one writing to S3. - -This code sets up a secure and controlled environment for the Fleet application to perform its necessary actions on the Firehose service within your AWS Account. - -If you wanted to make changes to the individual files to fit your environment, feel free. However, it's recommended to use a module like the example below for simplicity. - -``` -module "firehose_logging" { - source = "github.com/fleetdm/fleet//terraform/addons/byo-firehose-logging-destination/target-account" - - # Variables - osquery_logging_destination_bucket_name = {your-desired-bucket-prefix} - fleet_iam_role_arn = {supplied by Fleet} - sts_external_id = {if using} -} -``` -## Requirements - -| Name | Version | -|------|---------| -| [terraform](#requirement\_terraform) | >= 1.3.7 | -| [aws](#requirement\_aws) | >= 5.29.0 | - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | >= 5.29.0 | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [aws_iam_policy.firehose](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | -| [aws_iam_policy.fleet_firehose](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | -| [aws_iam_role.firehose](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | -| [aws_iam_role.fleet_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | -| [aws_iam_role_policy_attachment.firehose](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | -| [aws_iam_role_policy_attachment.fleet_firehose](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | -| [aws_kinesis_firehose_delivery_stream.fleet_log_destinations](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_firehose_delivery_stream) | resource | -| [aws_kms_key.firehose_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource | -| [aws_s3_bucket.destination](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource | -| [aws_s3_bucket_public_access_block.destination](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource | -| [aws_s3_bucket_server_side_encryption_configuration.destination](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource | -| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | -| [aws_iam_policy_document.assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.firehose](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.firehose_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.osquery_firehose_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_kms_alias.s3](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/kms_alias) | data source | -| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [fleet\_iam\_role\_arn](#input\_fleet\_iam\_role\_arn) | the arn of the fleet role that firehose will assume to write data to your bucket | `string` | n/a | yes | -| [kms\_key\_arn](#input\_kms\_key\_arn) | An optional KMS key ARN for server-side encryption. If not provided and encryption is enabled, a new key will be created. | `string` | `""` | no | -| [log\_destinations](#input\_log\_destinations) | A map of configurations for Firehose delivery streams. | 
map(object({
    name                = string
    prefix              = string
    error_output_prefix = string
    buffering_size      = number
    buffering_interval  = number
    compression_format  = string
  }))
| 
{
  "audit": {
    "buffering_interval": 120,
    "buffering_size": 20,
    "compression_format": "UNCOMPRESSED",
    "error_output_prefix": "audit/error/error=!{firehose:error-output-type}/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/",
    "name": "fleet_audit",
    "prefix": "audit/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/"
  },
  "results": {
    "buffering_interval": 120,
    "buffering_size": 20,
    "compression_format": "UNCOMPRESSED",
    "error_output_prefix": "results/error/error=!{firehose:error-output-type}/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/",
    "name": "osquery_results",
    "prefix": "results/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/"
  },
  "status": {
    "buffering_interval": 120,
    "buffering_size": 20,
    "compression_format": "UNCOMPRESSED",
    "error_output_prefix": "status/error/error=!{firehose:error-output-type}/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/",
    "name": "osquery_status",
    "prefix": "status/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/"
  }
}
| no | -| [osquery\_logging\_destination\_bucket\_name](#input\_osquery\_logging\_destination\_bucket\_name) | name of the bucket to store osquery results & status logs | `string` | n/a | yes | -| [server\_side\_encryption\_enabled](#input\_server\_side\_encryption\_enabled) | A boolean flag to enable/disable server-side encryption. Defaults to true (enabled). | `bool` | `true` | no | -| [sts\_external\_id](#input\_sts\_external\_id) | Optional unique identifier that can be used by the principal assuming the role to assert its identity. | `string` | `""` | no | - -## Outputs - -| Name | Description | -|------|-------------| -| [firehose\_iam\_role](#output\_firehose\_iam\_role) | n/a | -| [log\_destinations](#output\_log\_destinations) | Map of Firehose delivery streams' names. | -| [s3\_destination](#output\_s3\_destination) | n/a | diff --git a/terraform/addons/byo-firehose-logging-destination/target-account/firehose.tf b/terraform/addons/byo-firehose-logging-destination/target-account/firehose.tf deleted file mode 100644 index c4b45b7c2f40..000000000000 --- a/terraform/addons/byo-firehose-logging-destination/target-account/firehose.tf +++ /dev/null @@ -1,90 +0,0 @@ -data "aws_iam_policy_document" "osquery_firehose_assume_role" { - statement { - effect = "Allow" - actions = ["sts:AssumeRole"] - principals { - identifiers = ["firehose.amazonaws.com"] - type = "Service" - } - } -} - -data "aws_iam_policy_document" "firehose_policy" { - statement { - effect = "Allow" - actions = [ - "s3:AbortMultipartUpload", - "s3:GetBucketLocation", - "s3:GetObject", - "s3:ListBucket", - "s3:ListBucketMultipartUploads", - "s3:PutObject", - "s3:PutObjectAcl" // required according to https://docs.aws.amazon.com/firehose/latest/dev/controlling-access.html#using-iam-s3 - ] - resources = [ - aws_s3_bucket.destination.arn, - "${aws_s3_bucket.destination.arn}/*", - ] - } - - statement { - effect = "Allow" - actions = ["logs:PutLogEvents"] - resources = [ - for name in keys(var.log_destinations) : "arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:log-group:/aws/kinesisfirehose/${var.log_destinations[name].name}:*" - ] - } - - statement { - effect = "Allow" - actions = [ - "kms:Decrypt", - "kms:GenerateDataKey" - ] - resources = [data.aws_kms_alias.s3.arn] - } - -} - -resource "aws_iam_role" "firehose" { - assume_role_policy = data.aws_iam_policy_document.osquery_firehose_assume_role.json -} - -resource "aws_iam_policy" "firehose" { - policy = data.aws_iam_policy_document.firehose_policy.json -} - -resource "aws_iam_role_policy_attachment" "firehose" { - policy_arn = aws_iam_policy.firehose.arn - role = aws_iam_role.firehose.name -} - -resource "aws_kms_key" "firehose_key" { - count = var.server_side_encryption_enabled && length(var.kms_key_arn) == 0 ? 1 : 0 - description = "KMS key for encrypting Firehose data." -} - -resource "aws_kinesis_firehose_delivery_stream" "fleet_log_destinations" { - for_each = var.log_destinations - name = each.value.name - destination = "extended_s3" - - dynamic "server_side_encryption" { - for_each = var.server_side_encryption_enabled ? [1] : [] - content { - enabled = var.server_side_encryption_enabled - key_arn = length(var.kms_key_arn) > 0 ? var.kms_key_arn : aws_kms_key.firehose_key[0].arn - key_type = "CUSTOMER_MANAGED_CMK" - } - } - - extended_s3_configuration { - bucket_arn = aws_s3_bucket.destination.arn - role_arn = aws_iam_role.firehose.arn - prefix = each.value.prefix - error_output_prefix = each.value.error_output_prefix - buffering_size = each.value.buffering_size - buffering_interval = each.value.buffering_interval - compression_format = each.value.compression_format - } -} diff --git a/terraform/addons/byo-firehose-logging-destination/target-account/iam.tf b/terraform/addons/byo-firehose-logging-destination/target-account/iam.tf deleted file mode 100644 index 8f17b0b527bd..000000000000 --- a/terraform/addons/byo-firehose-logging-destination/target-account/iam.tf +++ /dev/null @@ -1,61 +0,0 @@ -resource "aws_iam_role" "fleet_role" { - assume_role_policy = data.aws_iam_policy_document.assume_role.json -} - -data "aws_iam_policy_document" "assume_role" { - statement { - effect = "Allow" - actions = ["sts:AssumeRole"] - principals { - identifiers = [var.fleet_iam_role_arn] - type = "AWS" - } - dynamic "condition" { - for_each = length(var.sts_external_id) > 0 ? [1] : [] - content { - test = "StringEquals" - variable = "sts:ExternalId" - values = [var.sts_external_id] - } - } - } -} - -data "aws_iam_policy_document" "firehose" { - statement { - effect = "Allow" - actions = [ - "firehose:DescribeDeliveryStream", - "firehose:PutRecord", - "firehose:PutRecordBatch", - ] - resources = [ - for stream in aws_kinesis_firehose_delivery_stream.fleet_log_destinations : stream.arn - ] - } - - dynamic "statement" { - for_each = var.server_side_encryption_enabled ? [1] : [] - - content { - effect = "Allow" - actions = [ - "kms:Decrypt", - "kms:GenerateDataKey", - ] - resources = [ - length(var.kms_key_arn) > 0 ? var.kms_key_arn : aws_kms_key.firehose_key[0].arn - ] - } - } - -} - -resource "aws_iam_policy" "fleet_firehose" { - policy = data.aws_iam_policy_document.firehose.json -} - -resource "aws_iam_role_policy_attachment" "fleet_firehose" { - policy_arn = aws_iam_policy.fleet_firehose.arn - role = aws_iam_role.fleet_role.name -} \ No newline at end of file diff --git a/terraform/addons/byo-firehose-logging-destination/target-account/outputs.tf b/terraform/addons/byo-firehose-logging-destination/target-account/outputs.tf deleted file mode 100644 index 97351d082365..000000000000 --- a/terraform/addons/byo-firehose-logging-destination/target-account/outputs.tf +++ /dev/null @@ -1,12 +0,0 @@ -output "firehose_iam_role" { - value = aws_iam_role.fleet_role.arn -} - -output "s3_destination" { - value = aws_s3_bucket.destination.arn -} - -output "log_destinations" { - description = "Map of Firehose delivery streams' names." - value = { for key, stream in aws_kinesis_firehose_delivery_stream.fleet_log_destinations : key => stream.name } -} diff --git a/terraform/addons/byo-firehose-logging-destination/target-account/s3.tf b/terraform/addons/byo-firehose-logging-destination/target-account/s3.tf deleted file mode 100644 index dafe961e555e..000000000000 --- a/terraform/addons/byo-firehose-logging-destination/target-account/s3.tf +++ /dev/null @@ -1,29 +0,0 @@ -data "aws_region" "current" {} -data "aws_caller_identity" "current" {} -data "aws_kms_alias" "s3" { - name = "alias/aws/s3" -} - -resource "aws_s3_bucket" "destination" { - bucket = var.osquery_logging_destination_bucket_name -} - -resource "aws_s3_bucket_public_access_block" "destination" { - bucket = aws_s3_bucket.destination.id - block_public_acls = true - block_public_policy = true - ignore_public_acls = true - restrict_public_buckets = true -} - -// Objects in S3 are now encrypted by default https://aws.amazon.com/blogs/aws/amazon-s3-encrypts-new-objects-by-default/ -// If you need more granular control, use a customer managed KMS Key -resource "aws_s3_bucket_server_side_encryption_configuration" "destination" { - bucket = aws_s3_bucket.destination.id - rule { - bucket_key_enabled = true - apply_server_side_encryption_by_default { - sse_algorithm = "aws:kms" - } - } -} diff --git a/terraform/addons/byo-firehose-logging-destination/target-account/variables.tf b/terraform/addons/byo-firehose-logging-destination/target-account/variables.tf deleted file mode 100644 index c44c28cf025d..000000000000 --- a/terraform/addons/byo-firehose-logging-destination/target-account/variables.tf +++ /dev/null @@ -1,65 +0,0 @@ -variable "osquery_logging_destination_bucket_name" { - type = string - description = "name of the bucket to store osquery results & status logs" -} - -variable "fleet_iam_role_arn" { - type = string - description = "The ARN of the IAM role that will be assumed to gain permissions required to write to the Kinesis Firehose delivery stream." -} - -variable "sts_external_id" { - type = string - description = "Optional unique identifier that can be used by the principal assuming the role to assert its identity." - default = "" -} - -variable "log_destinations" { - description = "A map of configurations for Firehose delivery streams." - type = map(object({ - name = string - prefix = string - error_output_prefix = string - buffering_size = number - buffering_interval = number - compression_format = string - })) - default = { - results = { - name = "osquery_results" - prefix = "results/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/" - error_output_prefix = "results/error/error=!{firehose:error-output-type}/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/" - buffering_size = 20 - buffering_interval = 120 - compression_format = "UNCOMPRESSED" - }, - status = { - name = "osquery_status" - prefix = "status/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/" - error_output_prefix = "status/error/error=!{firehose:error-output-type}/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/" - buffering_size = 20 - buffering_interval = 120 - compression_format = "UNCOMPRESSED" - }, - audit = { - name = "fleet_audit" - prefix = "audit/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/" - error_output_prefix = "audit/error/error=!{firehose:error-output-type}/year=!{timestamp:yyyy}/month=!{timestamp:MM}/day=!{timestamp:dd}/" - buffering_size = 20 - buffering_interval = 120 - compression_format = "UNCOMPRESSED" - } - } -} - -variable "server_side_encryption_enabled" { - description = "A boolean flag to enable/disable server-side encryption. Defaults to true (enabled)." - type = bool - default = true -} - -variable "kms_key_arn" { - description = "An optional KMS key ARN for server-side encryption. If not provided and encryption is enabled, a new key will be created." - type = string - default = "" -} \ No newline at end of file diff --git a/terraform/addons/byo-firehose-logging-destination/target-account/version.tf b/terraform/addons/byo-firehose-logging-destination/target-account/version.tf deleted file mode 100644 index 529d9d07acce..000000000000 --- a/terraform/addons/byo-firehose-logging-destination/target-account/version.tf +++ /dev/null @@ -1,10 +0,0 @@ -terraform { - required_version = ">= 1.3.7" - - required_providers { - aws = { - source = "hashicorp/aws" - version = ">= 5.29.0" - } - } -} \ No newline at end of file diff --git a/terraform/addons/byo-kinesis-logging-destination/.header.md b/terraform/addons/byo-kinesis-logging-destination/.header.md deleted file mode 100644 index e29d62d1cf2b..000000000000 --- a/terraform/addons/byo-kinesis-logging-destination/.header.md +++ /dev/null @@ -1,6 +0,0 @@ -# Logging Destination: Kinesis -This addon provides a Kinesis Data Stream logging destination for Fleet. - -First apply the `target-account` module which will provision the necessary data streams, KMS key, and policies. - -Then apply the `kinesis` module with the required variables. diff --git a/terraform/addons/byo-kinesis-logging-destination/kinesis/.header.md b/terraform/addons/byo-kinesis-logging-destination/kinesis/.header.md deleted file mode 100644 index 441c86e5ed7e..000000000000 --- a/terraform/addons/byo-kinesis-logging-destination/kinesis/.header.md +++ /dev/null @@ -1,28 +0,0 @@ -# Kinesis Data Stream Logging Destination Setup - -## Usage - -After `./target-account` module is applied you might use this module in the following manner: - -```hcl -module "kinesis" { - source = "../../../../fleet/terraform/addons/byo-kinesis-logging-destination/kinesis" - kinesis_results_name = "testing-log-stream" - kinesis_status_name = "testing-log-stream" - kinesis_audit_name = "testing-log-stream" - iam_role_arn = "arn:aws:iam::123456789:role/terraform-20240524165353382600000001" - region = "us-east-2" -} -``` - -And then supply the outputs to the `fleet_config` definition: -```hcl -fleet_config = { - image = local.fleet_image - extra_iam_policies = concat(module.kinesis.fleet_extra_iam_policies) - extra_environment_variables = merge( - local.extra_environment_variables, - module.kinesis.fleet_extra_environment_variables, - ) - } -``` diff --git a/terraform/addons/byo-kinesis-logging-destination/kinesis/.terraform-docs.yml b/terraform/addons/byo-kinesis-logging-destination/kinesis/.terraform-docs.yml deleted file mode 100644 index 1d139ddb401d..000000000000 --- a/terraform/addons/byo-kinesis-logging-destination/kinesis/.terraform-docs.yml +++ /dev/null @@ -1 +0,0 @@ -header-from: .header.md diff --git a/terraform/addons/byo-kinesis-logging-destination/kinesis/README.md b/terraform/addons/byo-kinesis-logging-destination/kinesis/README.md deleted file mode 100644 index 2eedf9bc92b3..000000000000 --- a/terraform/addons/byo-kinesis-logging-destination/kinesis/README.md +++ /dev/null @@ -1,70 +0,0 @@ -# Kinesis Data Stream Logging Destination Setup - -## Usage - -After `./target-account` module is applied you might use this module in the following manner: - -```hcl -module "kinesis" { - source = "../../../../fleet/terraform/addons/byo-kinesis-logging-destination/kinesis" - kinesis_results_name = "testing-log-stream" - kinesis_status_name = "testing-log-stream" - kinesis_audit_name = "testing-log-stream" - iam_role_arn = "arn:aws:iam::123456789:role/terraform-20240524165353382600000001" - region = "us-east-2" -} -``` - -And then supply the outputs to the `fleet_config` definition: -```hcl -fleet_config = { - image = local.fleet_image - extra_iam_policies = concat(module.kinesis.fleet_extra_iam_policies) - extra_environment_variables = merge( - local.extra_environment_variables, - module.kinesis.fleet_extra_environment_variables, - ) - } -``` - -## Requirements - -| Name | Version | -|------|---------| -| [terraform](#requirement\_terraform) | >= 1.3.7 | -| [aws](#requirement\_aws) | >= 4.52.0 | - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | >= 4.52.0 | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [aws_iam_policy.fleet-assume-role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | -| [aws_iam_policy_document.fleet-assume-role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [iam\_role\_arn](#input\_iam\_role\_arn) | IAM Role ARN to use for Kinesis destination logging | `string` | n/a | yes | -| [kinesis\_audit\_name](#input\_kinesis\_audit\_name) | name of the kinesis data stream for fleet audit logs | `string` | n/a | yes | -| [kinesis\_results\_name](#input\_kinesis\_results\_name) | name of the kinesis data stream for osquery results logs | `string` | n/a | yes | -| [kinesis\_status\_name](#input\_kinesis\_status\_name) | name of the kinesis data stream for osquery status logs | `string` | n/a | yes | -| [region](#input\_region) | region the target kinesis data stream(s) is in | `string` | n/a | yes | -| [sts\_external\_id](#input\_sts\_external\_id) | Optional unique identifier that can be used by the principal assuming the role to assert its identity. | `string` | `""` | no | - -## Outputs - -| Name | Description | -|------|-------------| -| [fleet\_extra\_environment\_variables](#output\_fleet\_extra\_environment\_variables) | n/a | -| [fleet\_extra\_iam\_policies](#output\_fleet\_extra\_iam\_policies) | n/a | diff --git a/terraform/addons/byo-kinesis-logging-destination/kinesis/iam.tf b/terraform/addons/byo-kinesis-logging-destination/kinesis/iam.tf deleted file mode 100644 index d394ab86ae6a..000000000000 --- a/terraform/addons/byo-kinesis-logging-destination/kinesis/iam.tf +++ /dev/null @@ -1,11 +0,0 @@ -data "aws_iam_policy_document" "fleet-assume-role" { - statement { - effect = "Allow" - actions = ["sts:AssumeRole"] - resources = [var.iam_role_arn] - } -} - -resource "aws_iam_policy" "fleet-assume-role" { - policy = data.aws_iam_policy_document.fleet-assume-role.json -} \ No newline at end of file diff --git a/terraform/addons/byo-kinesis-logging-destination/kinesis/outputs.tf b/terraform/addons/byo-kinesis-logging-destination/kinesis/outputs.tf deleted file mode 100644 index 35c76726da39..000000000000 --- a/terraform/addons/byo-kinesis-logging-destination/kinesis/outputs.tf +++ /dev/null @@ -1,20 +0,0 @@ -output "fleet_extra_environment_variables" { - value = { - FLEET_KINESIS_STATUS_STREAM = var.kinesis_status_name - FLEET_KINESIS_RESULT_STREAM = var.kinesis_results_name - FLEET_KINESIS_AUDIT_STREAM = var.kinesis_audit_name - FLEET_KINESIS_STS_ASSUME_ROLE_ARN = var.iam_role_arn - FLEET_KINESIS_STS_EXTERNAL_ID = var.sts_external_id - FLEET_KINESIS_REGION = var.region - FLEET_OSQUERY_STATUS_LOG_PLUGIN = length(var.kinesis_status_name) > 0 ? "kinesis" : "" - FLEET_OSQUERY_RESULT_LOG_PLUGIN = length(var.kinesis_results_name) > 0 ? "kinesis" : "" - FLEET_ACTIVITY_AUDIT_LOG_PLUGIN = length(var.kinesis_audit_name) > 0 ? "kinesis" : "" - FLEET_ACTIVITY_ENABLE_AUDIT_LOG = length(var.kinesis_audit_name) > 0 ? "true" : "false" - } -} - -output "fleet_extra_iam_policies" { - value = [ - aws_iam_policy.fleet-assume-role.arn - ] -} diff --git a/terraform/addons/byo-kinesis-logging-destination/kinesis/variables.tf b/terraform/addons/byo-kinesis-logging-destination/kinesis/variables.tf deleted file mode 100644 index c1c1df3051fc..000000000000 --- a/terraform/addons/byo-kinesis-logging-destination/kinesis/variables.tf +++ /dev/null @@ -1,30 +0,0 @@ -variable "iam_role_arn" { - type = string - description = "IAM Role ARN to use for Kinesis destination logging" -} - -variable "kinesis_results_name" { - type = string - description = "name of the kinesis data stream for osquery results logs" -} - -variable "kinesis_status_name" { - type = string - description = "name of the kinesis data stream for osquery status logs" -} - -variable "kinesis_audit_name" { - type = string - description = "name of the kinesis data stream for fleet audit logs" -} - -variable "region" { - type = string - description = "region the target kinesis data stream(s) is in" -} - -variable "sts_external_id" { - type = string - description = "Optional unique identifier that can be used by the principal assuming the role to assert its identity." - default = "" -} diff --git a/terraform/addons/byo-kinesis-logging-destination/kinesis/version.tf b/terraform/addons/byo-kinesis-logging-destination/kinesis/version.tf deleted file mode 100644 index 529d9d07acce..000000000000 --- a/terraform/addons/byo-kinesis-logging-destination/kinesis/version.tf +++ /dev/null @@ -1,10 +0,0 @@ -terraform { - required_version = ">= 1.3.7" - - required_providers { - aws = { - source = "hashicorp/aws" - version = ">= 5.29.0" - } - } -} \ No newline at end of file diff --git a/terraform/addons/byo-kinesis-logging-destination/target-account/.header.md b/terraform/addons/byo-kinesis-logging-destination/target-account/.header.md deleted file mode 100644 index 478b757f0903..000000000000 --- a/terraform/addons/byo-kinesis-logging-destination/target-account/.header.md +++ /dev/null @@ -1,83 +0,0 @@ -# Kinesis Data Stream Logging Destination Setup - -## How to use - -Below is an example of defining the module to use a single Kinesis Data Stream for all log types (results, status, and audit): -```hcl -module "kinesis" { - source = "github.com/fleetdm/fleet//terraform/addons/byo-kinesis-logging-destination/target-account" - - fleet_iam_role_arn = "arn:aws:iam::123456789:role/fleet-server-role" # this is the ARN of the IAM (ECS-task) role the fleet servers are running as - log_destinations = { - test = { - name = "unified-log-stream" - shard_count = 0 # shard count only matters if `stream_mode` is `PROVISIONED` - stream_mode = "ON_DEMAND" # valid values are `ON_DEMAND` or `PROVISIONED` - retention_period = 24 # number of hours you want the data to be retained on the stream - shard_level_metrics = [] # IncomingBytes IncomingRecords OutgoingBytes OutgoingRecords WriteProvisionedThroughputExceeded ReadProvisionedThroughputExceeded IteratorAgeMilliseconds - } - } -} - -output "kinesis_logging_destination" { - value = module.kinesis -} -``` - -If you desired a Kinesis Data Stream per "topic": -```hcl -module "kinesis" { - source = "github.com/fleetdm/fleet//terraform/addons/byo-kinesis-logging-destination/target-account" - - fleet_iam_role_arn = "arn:aws:iam::123456789:role/fleet-server-role" # this is the ARN of the IAM (ECS-task) role the fleet servers are running as - log_destinations = { - results = { - name = "osquery-results" - shard_count = 0 # shard count only matters if `stream_mode` is `PROVISIONED` - stream_mode = "ON_DEMAND" # valid values are `ON_DEMAND` or `PROVISIONED` - retention_period = 24 # number of hours you want the data to be retained on the stream - shard_level_metrics = [] # IncomingBytes IncomingRecords OutgoingBytes OutgoingRecords WriteProvisionedThroughputExceeded ReadProvisionedThroughputExceeded IteratorAgeMilliseconds - } - status = { - name = "osquery-status" - shard_count = 0 # shard count only matters if `stream_mode` is `PROVISIONED` - stream_mode = "ON_DEMAND" # valid values are `ON_DEMAND` or `PROVISIONED` - retention_period = 24 # number of hours you want the data to be retained on the stream - shard_level_metrics = [] # IncomingBytes IncomingRecords OutgoingBytes OutgoingRecords WriteProvisionedThroughputExceeded ReadProvisionedThroughputExceeded IteratorAgeMilliseconds - } - audit = { - name = "fleet-audit" - shard_count = 0 # shard count only matters if `stream_mode` is `PROVISIONED` - stream_mode = "ON_DEMAND" # valid values are `ON_DEMAND` or `PROVISIONED` - retention_period = 24 # number of hours you want the data to be retained on the stream - shard_level_metrics = [] # IncomingBytes IncomingRecords OutgoingBytes OutgoingRecords WriteProvisionedThroughputExceeded ReadProvisionedThroughputExceeded IteratorAgeMilliseconds - } - } -} - -output "kinesis_logging_destination" { - value = module.kinesis -} -``` - -1. **Variables:** - - `fleet_iam_role_arn`: A string variable that holds the ARN of the IAM role which will assume the role defined in this module to gain permissions for writing to the Kinesis Data Streams. - - `sts_external_id`: An optional string variable that can be used as a unique identifier for the principal assuming the role to assert its identity. Default is an empty string. - - `log_destinations`: A map variable that contains configurations for multiple Kinesis Data Streams. Each stream configuration includes its name, shard count, stream mode, retention period, and shard-level metrics. Default values are provided for three streams: `osquery_results`, `osquery_status`, and `fleet_audit`. - -2. **IAM Role:** - - `aws_iam_role.fleet_role`: Creates an IAM role with a trust policy that allows the specified IAM role ARN (`fleet_iam_role_arn`) to assume this role. If `sts_external_id` is provided, it adds a condition to the trust policy to require this external ID for the assume role operation. - -3. **IAM Policy Documents:** - - `data.aws_iam_policy_document.assume_role`: Defines the assume role policy for the IAM role. It allows the specified actions (`sts:AssumeRole`) for the specified principals. - - `data.aws_iam_policy_document.kinesis`: Defines the policy document allowing the IAM role to perform Kinesis and KMS actions. It allows the IAM role to describe, put records into the Kinesis streams (defined in `log_destinations`), and use KMS keys for encryption. - -4. **IAM Policy and Attachment:** - - `aws_iam_policy.fleet_kinesis`: Creates an IAM policy using the defined policy document (`data.aws_iam_policy_document.kinesis`). - - `aws_iam_role_policy_attachment.fleet_kinesis`: Attaches the created IAM policy to the IAM role (`aws_iam_role.fleet_role`). - -5. **KMS Key:** - - `aws_kms_key.kinesis_key`: Creates a KMS key for encrypting the Kinesis Data Streams. - -6. **Kinesis Data Streams:** - - `aws_kinesis_stream.fleet_log_destination`: Provisions Kinesis Data Streams based on the configurations defined in `log_destinations`. Each stream is created with the specified name, encryption type (using the KMS key), shard-level metrics, shard count (if the stream mode is not "ON_DEMAND"), and stream mode. diff --git a/terraform/addons/byo-kinesis-logging-destination/target-account/.terraform-docs.yml b/terraform/addons/byo-kinesis-logging-destination/target-account/.terraform-docs.yml deleted file mode 100644 index 1d139ddb401d..000000000000 --- a/terraform/addons/byo-kinesis-logging-destination/target-account/.terraform-docs.yml +++ /dev/null @@ -1 +0,0 @@ -header-from: .header.md diff --git a/terraform/addons/byo-kinesis-logging-destination/target-account/.terraform.lock.hcl b/terraform/addons/byo-kinesis-logging-destination/target-account/.terraform.lock.hcl deleted file mode 100644 index d5b523dfe59c..000000000000 --- a/terraform/addons/byo-kinesis-logging-destination/target-account/.terraform.lock.hcl +++ /dev/null @@ -1,25 +0,0 @@ -# This file is maintained automatically by "terraform init". -# Manual edits may be lost in future updates. - -provider "registry.terraform.io/hashicorp/aws" { - version = "5.51.0" - constraints = ">= 5.29.0" - hashes = [ - "h1:AUyje9jt9NYDbdFJwxLYtMEodb3PZptGsftpuB0xSgQ=", - "zh:049a4292dbf6afc2445d9fc796258ae33a989fd9a68b84f6e51c42c46dc2e45d", - "zh:0c1cd2d0e58727afe037d4ba0daeac0be3e0076d971ffa019cd4a03e1e8e7d50", - "zh:16ac968deddd08bd0e164532bfa961ef27785cb7beb57373637fb54eebbcef4f", - "zh:1740a6393e48a7ee357f53ac75025bb7eb56e21887cd28fbd996bb7c405fad85", - "zh:1e6667f3fca893cb3d333027f15e5965e45b29343a23b4d84ee787d2af732fc2", - "zh:543c8b780051623cb3a8558d9ed1f2ee51a801f839777a8f97e854e0b67e745e", - "zh:784d7e1791c75e10ff457ff75836bb3230b63c72f41cd63dc021381984661820", - "zh:857b37528e40a0ffe4f06ce9580bc4f88209bb9a0864f482c898ce8494b7347f", - "zh:94d15a0f4662a04c88cba1ba2710aed506331b47aaad36f36734fcba64d64294", - "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", - "zh:ba78a03cdc2bf56f48c19e2a37930f4bb8dfe818fc21f039fb785a22221d1fcf", - "zh:c9681a67ba51540905031063217fd8e48888c5ed3c9394d571d7d7ee333a5fbd", - "zh:d5d15bae5357854bd8df7490628ca949ef4c61481d3f4c3c535b0142261f93e4", - "zh:d96b28f58af08ab4d9057611e612634e96cafacaacf481dc08caf4dff06bbeee", - "zh:ed7652b4da81f2e7efe4821460aa77ba811e94afb4ef02afe067c1f166ee37d1", - ] -} diff --git a/terraform/addons/byo-kinesis-logging-destination/target-account/README.md b/terraform/addons/byo-kinesis-logging-destination/target-account/README.md deleted file mode 100644 index e54c0b4f4ea4..000000000000 --- a/terraform/addons/byo-kinesis-logging-destination/target-account/README.md +++ /dev/null @@ -1,127 +0,0 @@ -# Kinesis Data Stream Logging Destination Setup - -## How to use - -Below is an example of defining the module to use a single Kinesis Data Stream for all log types (results, status, and audit): -```hcl -module "kinesis" { - source = "github.com/fleetdm/fleet//terraform/addons/byo-kinesis-logging-destination/target-account" - - fleet_iam_role_arn = "arn:aws:iam::123456789:role/fleet-server-role" # this is the ARN of the IAM (ECS-task) role the fleet servers are running as - log_destinations = { - test = { - name = "unified-log-stream" - shard_count = 0 # shard count only matters if `stream_mode` is `PROVISIONED` - stream_mode = "ON_DEMAND" # valid values are `ON_DEMAND` or `PROVISIONED` - retention_period = 24 # number of hours you want the data to be retained on the stream - shard_level_metrics = [] # IncomingBytes IncomingRecords OutgoingBytes OutgoingRecords WriteProvisionedThroughputExceeded ReadProvisionedThroughputExceeded IteratorAgeMilliseconds - } - } -} - -output "kinesis_logging_destination" { - value = module.kinesis -} -``` - -If you desired a Kinesis Data Stream per "topic": -```hcl -module "kinesis" { - source = "github.com/fleetdm/fleet//terraform/addons/byo-kinesis-logging-destination/target-account" - - fleet_iam_role_arn = "arn:aws:iam::123456789:role/fleet-server-role" # this is the ARN of the IAM (ECS-task) role the fleet servers are running as - log_destinations = { - results = { - name = "osquery-results" - shard_count = 0 # shard count only matters if `stream_mode` is `PROVISIONED` - stream_mode = "ON_DEMAND" # valid values are `ON_DEMAND` or `PROVISIONED` - retention_period = 24 # number of hours you want the data to be retained on the stream - shard_level_metrics = [] # IncomingBytes IncomingRecords OutgoingBytes OutgoingRecords WriteProvisionedThroughputExceeded ReadProvisionedThroughputExceeded IteratorAgeMilliseconds - } - status = { - name = "osquery-status" - shard_count = 0 # shard count only matters if `stream_mode` is `PROVISIONED` - stream_mode = "ON_DEMAND" # valid values are `ON_DEMAND` or `PROVISIONED` - retention_period = 24 # number of hours you want the data to be retained on the stream - shard_level_metrics = [] # IncomingBytes IncomingRecords OutgoingBytes OutgoingRecords WriteProvisionedThroughputExceeded ReadProvisionedThroughputExceeded IteratorAgeMilliseconds - } - audit = { - name = "fleet-audit" - shard_count = 0 # shard count only matters if `stream_mode` is `PROVISIONED` - stream_mode = "ON_DEMAND" # valid values are `ON_DEMAND` or `PROVISIONED` - retention_period = 24 # number of hours you want the data to be retained on the stream - shard_level_metrics = [] # IncomingBytes IncomingRecords OutgoingBytes OutgoingRecords WriteProvisionedThroughputExceeded ReadProvisionedThroughputExceeded IteratorAgeMilliseconds - } - } -} - -output "kinesis_logging_destination" { - value = module.kinesis -} -``` - -1. **Variables:** - - `fleet_iam_role_arn`: A string variable that holds the ARN of the IAM role which will assume the role defined in this module to gain permissions for writing to the Kinesis Data Streams. - - `sts_external_id`: An optional string variable that can be used as a unique identifier for the principal assuming the role to assert its identity. Default is an empty string. - - `log_destinations`: A map variable that contains configurations for multiple Kinesis Data Streams. Each stream configuration includes its name, shard count, stream mode, retention period, and shard-level metrics. Default values are provided for three streams: `osquery_results`, `osquery_status`, and `fleet_audit`. - -2. **IAM Role:** - - `aws_iam_role.fleet_role`: Creates an IAM role with a trust policy that allows the specified IAM role ARN (`fleet_iam_role_arn`) to assume this role. If `sts_external_id` is provided, it adds a condition to the trust policy to require this external ID for the assume role operation. - -3. **IAM Policy Documents:** - - `data.aws_iam_policy_document.assume_role`: Defines the assume role policy for the IAM role. It allows the specified actions (`sts:AssumeRole`) for the specified principals. - - `data.aws_iam_policy_document.kinesis`: Defines the policy document allowing the IAM role to perform Kinesis and KMS actions. It allows the IAM role to describe, put records into the Kinesis streams (defined in `log_destinations`), and use KMS keys for encryption. - -4. **IAM Policy and Attachment:** - - `aws_iam_policy.fleet_kinesis`: Creates an IAM policy using the defined policy document (`data.aws_iam_policy_document.kinesis`). - - `aws_iam_role_policy_attachment.fleet_kinesis`: Attaches the created IAM policy to the IAM role (`aws_iam_role.fleet_role`). - -5. **KMS Key:** - - `aws_kms_key.kinesis_key`: Creates a KMS key for encrypting the Kinesis Data Streams. - -6. **Kinesis Data Streams:** - - `aws_kinesis_stream.fleet_log_destination`: Provisions Kinesis Data Streams based on the configurations defined in `log_destinations`. Each stream is created with the specified name, encryption type (using the KMS key), shard-level metrics, shard count (if the stream mode is not "ON\_DEMAND"), and stream mode. - -## Requirements - -| Name | Version | -|------|---------| -| [terraform](#requirement\_terraform) | >= 1.3.7 | -| [aws](#requirement\_aws) | >= 5.29.0 | - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | 5.51.0 | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [aws_iam_policy.fleet_kinesis](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | -| [aws_iam_role.fleet_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | -| [aws_iam_role_policy_attachment.fleet_kinesis](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | -| [aws_kinesis_stream.fleet_log_destination](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_stream) | resource | -| [aws_kms_key.kinesis_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource | -| [aws_iam_policy_document.assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.kinesis](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [fleet\_iam\_role\_arn](#input\_fleet\_iam\_role\_arn) | The ARN of the IAM role that will be assuming into the IAM role defined in this module to gain permissions required to write to the Kinesis Data Stream(s). | `string` | n/a | yes | -| [log\_destinations](#input\_log\_destinations) | A map of configurations for Kinesis data streams. | 
map(object({
    name                = string
    shard_count         = number
    stream_mode         = string
    retention_period    = number
    shard_level_metrics = list(string)
  }))
| 
{
  "audit": {
    "name": "fleet_audit",
    "retention_period": 24,
    "shard_count": 0,
    "shard_level_metrics": [],
    "stream_mode": "ON_DEMAND"
  },
  "results": {
    "name": "osquery_results",
    "retention_period": 24,
    "shard_count": 0,
    "shard_level_metrics": [],
    "stream_mode": "ON_DEMAND"
  },
  "status": {
    "name": "osquery_status",
    "retention_period": 24,
    "shard_count": 0,
    "shard_level_metrics": [],
    "stream_mode": "ON_DEMAND"
  }
}
| no | -| [sts\_external\_id](#input\_sts\_external\_id) | Optional unique identifier that can be used by the principal assuming the role to assert its identity. | `string` | `""` | no | - -## Outputs - -| Name | Description | -|------|-------------| -| [kinesis\_iam\_role](#output\_kinesis\_iam\_role) | n/a | -| [kinesis\_streams](#output\_kinesis\_streams) | A map of Kinesis streams with their names and ARNs. | diff --git a/terraform/addons/byo-kinesis-logging-destination/target-account/iam.tf b/terraform/addons/byo-kinesis-logging-destination/target-account/iam.tf deleted file mode 100644 index 95671c43e105..000000000000 --- a/terraform/addons/byo-kinesis-logging-destination/target-account/iam.tf +++ /dev/null @@ -1,57 +0,0 @@ -resource "aws_iam_role" "fleet_role" { - assume_role_policy = data.aws_iam_policy_document.assume_role.json -} - -data "aws_iam_policy_document" "assume_role" { - statement { - effect = "Allow" - actions = ["sts:AssumeRole"] - principals { - identifiers = [var.fleet_iam_role_arn] - type = "AWS" - } - dynamic "condition" { - for_each = length(var.sts_external_id) > 0 ? [1] : [] - content { - test = "StringEquals" - variable = "sts:ExternalId" - values = [var.sts_external_id] - } - } - } -} - -data "aws_iam_policy_document" "kinesis" { - statement { - effect = "Allow" - actions = [ - "kinesis:DescribeStreamSummary", - "kinesis:DescribeStream", - "kinesis:PutRecord", - "kinesis:PutRecords" - ] - resources = [ - for stream in aws_kinesis_stream.fleet_log_destination : stream.arn - ] - } - - statement { - effect = "Allow" - actions = [ - "kms:Decrypt", - "kms:GenerateDataKey", - ] - resources = [ - aws_kms_key.kinesis_key.arn - ] - } -} - -resource "aws_iam_policy" "fleet_kinesis" { - policy = data.aws_iam_policy_document.kinesis.json -} - -resource "aws_iam_role_policy_attachment" "fleet_kinesis" { - policy_arn = aws_iam_policy.fleet_kinesis.arn - role = aws_iam_role.fleet_role.name -} \ No newline at end of file diff --git a/terraform/addons/byo-kinesis-logging-destination/target-account/kinesis.tf b/terraform/addons/byo-kinesis-logging-destination/target-account/kinesis.tf deleted file mode 100644 index 4271d13061b0..000000000000 --- a/terraform/addons/byo-kinesis-logging-destination/target-account/kinesis.tf +++ /dev/null @@ -1,15 +0,0 @@ -resource "aws_kms_key" "kinesis_key" { - description = "KMS key for encrypting Kinesis Data Streams for Fleet logging destinations." -} - -resource "aws_kinesis_stream" "fleet_log_destination" { - for_each = var.log_destinations - name = each.value.name - encryption_type = "KMS" - kms_key_id = aws_kms_key.kinesis_key.id - shard_level_metrics = each.value.shard_level_metrics - shard_count = each.value.stream_mode == "ON_DEMAND" ? null : each.value.shard_count - stream_mode_details { - stream_mode = each.value.stream_mode - } -} diff --git a/terraform/addons/byo-kinesis-logging-destination/target-account/outputs.tf b/terraform/addons/byo-kinesis-logging-destination/target-account/outputs.tf deleted file mode 100644 index 21a83a3192d4..000000000000 --- a/terraform/addons/byo-kinesis-logging-destination/target-account/outputs.tf +++ /dev/null @@ -1,13 +0,0 @@ -output "kinesis_iam_role" { - value = aws_iam_role.fleet_role.arn -} - -output "kinesis_streams" { - description = "A map of Kinesis streams with their names and ARNs." - value = { - for k, stream in aws_kinesis_stream.fleet_log_destination : k => { - stream_name = stream.name - stream_arn = stream.arn - } - } -} diff --git a/terraform/addons/byo-kinesis-logging-destination/target-account/variables.tf b/terraform/addons/byo-kinesis-logging-destination/target-account/variables.tf deleted file mode 100644 index b65a6c86d74c..000000000000 --- a/terraform/addons/byo-kinesis-logging-destination/target-account/variables.tf +++ /dev/null @@ -1,44 +0,0 @@ -variable "fleet_iam_role_arn" { - type = string - description = "The ARN of the IAM role that will be assuming into the IAM role defined in this module to gain permissions required to write to the Kinesis Data Stream(s)." -} - -variable "sts_external_id" { - type = string - description = "Optional unique identifier that can be used by the principal assuming the role to assert its identity." - default = "" -} - -variable "log_destinations" { - description = "A map of configurations for Kinesis data streams." - type = map(object({ - name = string - shard_count = number - stream_mode = string - retention_period = number - shard_level_metrics = list(string) - })) - default = { - results = { - name = "osquery_results" - shard_count = 0 - stream_mode = "ON_DEMAND" - retention_period = 24 - shard_level_metrics = [] - }, - status = { - name = "osquery_status" - shard_count = 0 - stream_mode = "ON_DEMAND" - retention_period = 24 - shard_level_metrics = [] - }, - audit = { - name = "fleet_audit" - shard_count = 0 - stream_mode = "ON_DEMAND" - retention_period = 24 - shard_level_metrics = [] - } - } -} \ No newline at end of file diff --git a/terraform/addons/byo-kinesis-logging-destination/target-account/version.tf b/terraform/addons/byo-kinesis-logging-destination/target-account/version.tf deleted file mode 100644 index 529d9d07acce..000000000000 --- a/terraform/addons/byo-kinesis-logging-destination/target-account/version.tf +++ /dev/null @@ -1,10 +0,0 @@ -terraform { - required_version = ">= 1.3.7" - - required_providers { - aws = { - source = "hashicorp/aws" - version = ">= 5.29.0" - } - } -} \ No newline at end of file diff --git a/terraform/addons/external-vuln-scans/.header.md b/terraform/addons/external-vuln-scans/.header.md deleted file mode 100644 index 29d4b5775f05..000000000000 --- a/terraform/addons/external-vuln-scans/.header.md +++ /dev/null @@ -1,10 +0,0 @@ -# External Vulnerability Scans addon -This addon creates an additional ECS service that only runs a single task, responsible for vuln processing. It receives -no web traffic. We utilize [current instance checks](https://fleetdm.com/docs/configuration/fleet-server-configuration#current-instance-checks) to make this happen. The advantages of this mechanism: - -1. dedicating processing power to vuln processing - 2. ensures task responsible for vuln processing isn't also trying to serve web traffic -2. caching of vulnerability artifacts/dependencies - - -Usage is simplified by using the output from the fleet byo-ecs module (../terraform/byo-vpc/byo-db/byo-ecs/README.md) diff --git a/terraform/addons/external-vuln-scans/.terraform-docs.yml b/terraform/addons/external-vuln-scans/.terraform-docs.yml deleted file mode 100644 index 1d139ddb401d..000000000000 --- a/terraform/addons/external-vuln-scans/.terraform-docs.yml +++ /dev/null @@ -1 +0,0 @@ -header-from: .header.md diff --git a/terraform/addons/external-vuln-scans/.terraform.lock.hcl b/terraform/addons/external-vuln-scans/.terraform.lock.hcl deleted file mode 100644 index f284c8030c37..000000000000 --- a/terraform/addons/external-vuln-scans/.terraform.lock.hcl +++ /dev/null @@ -1,25 +0,0 @@ -# This file is maintained automatically by "terraform init". -# Manual edits may be lost in future updates. - -provider "registry.terraform.io/hashicorp/aws" { - version = "5.11.0" - hashes = [ - "h1:OyEBhYcTPChBb0gooSlLIcrxakh72qAN+Sd8Oo12uoc=", - "h1:Wo6WCPXNnbyeRp57Jvlp7VBm9acVAAg6jVmFRU2IWjk=", - "zh:2913af44f9b584f756e5548d5ddc5a251c6d68a7fcd7c41d1418a800a94ef113", - "zh:31d2bfa84608b74ff5896f41b09e5927d7c37d18875277a51dcd75a1fea3f909", - "zh:8538ff18e3b4822178e793f06764efdbb84c62227c1051af7d2409ab7be37bfc", - "zh:8a9295e623327613fc02a6994e73c61b9d0d195bf6fabdb31ee9fd0e6778f62b", - "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", - "zh:a65877248951eadf0d16a3260e85f6b178645da7f1897bc7bda6f12fdbec8e47", - "zh:a70772851e2c87cc1e10c35389718a544746adc4acbbed129243c0972c367fc6", - "zh:b10ca631318f8d1d9a2baa318139bc9e545e51efaf677afece173badce75b44c", - "zh:ca2a5698c33158549fa084ad601610eae94498cba445458391b507da22355402", - "zh:cdbfc4d64161561bfbcaee5d9b078077ed986131a1eab32ff30e71be09037eec", - "zh:ce499f93835bf3d28c13ba98a0a220ff541a827fb400fa931601a375b907b56d", - "zh:da6af610e66e96280a299071a698568b505c2456bb15c906304d6f39578c72e3", - "zh:e42714e085126c10d8f29664143f97d771b6cc6887d27cdf6c4007ab12af4646", - "zh:e86dd0c561c73512acba69f55041adfc04d0467f592f52337a7ac600fbc93680", - "zh:f5da95bbd44809534c6678e9b1ae0b390331a5619f2ae353c6b88e96ae855cc0", - ] -} diff --git a/terraform/addons/external-vuln-scans/README.md b/terraform/addons/external-vuln-scans/README.md deleted file mode 100644 index b7a030a2063f..000000000000 --- a/terraform/addons/external-vuln-scans/README.md +++ /dev/null @@ -1,57 +0,0 @@ -# External Vulnerability Scans addon -This addon creates an additional ECS service that only runs a single task, responsible for vuln processing. It receives -no web traffic. We utilize [current instance checks](https://fleetdm.com/docs/configuration/fleet-server-configuration#current-instance-checks) to make this happen. The advantages of this mechanism: - -1. dedicating processing power to vuln processing - 2. ensures task responsible for vuln processing isn't also trying to serve web traffic -2. caching of vulnerability artifacts/dependencies - -Usage is simplified by using the output from the fleet byo-ecs module (../terraform/byo-vpc/byo-db/byo-ecs/README.md) - -## Requirements - -No requirements. - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | 5.11.0 | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [aws_ecs_service.fleet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_service) | resource | -| [aws_ecs_task_definition.vuln-processing](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_task_definition) | resource | -| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [awslogs\_config](#input\_awslogs\_config) | n/a | 
object({
    group  = string
    region = string
    prefix = string
  })
| n/a | yes | -| [customer\_prefix](#input\_customer\_prefix) | n/a | `string` | `"fleet"` | no | -| [ecs\_cluster](#input\_ecs\_cluster) | The ecs cluster module that is created by the byo-db module | `any` | n/a | yes | -| [execution\_iam\_role\_arn](#input\_execution\_iam\_role\_arn) | The ARN of the fleet execution role, this is necessary to pass role from ecs events | `any` | n/a | yes | -| [fleet\_config](#input\_fleet\_config) | The root Fleet config object | `any` | n/a | yes | -| [fleet\_s3\_software\_installers\_config](#input\_fleet\_s3\_software\_installers\_config) | use the output of the byo-vpc module with the same name | `map(string)` | n/a | yes | -| [fleet\_server\_private\_key\_secret\_arn](#input\_fleet\_server\_private\_key\_secret\_arn) | The ARN of the secret that stores the Fleet private key | `string` | n/a | yes | -| [security\_groups](#input\_security\_groups) | n/a | `list(string)` | n/a | yes | -| [subnets](#input\_subnets) | n/a | `list(string)` | n/a | yes | -| [task\_role\_arn](#input\_task\_role\_arn) | The ARN of the fleet task role, this is necessary to pass role from ecs events | `any` | n/a | yes | -| [vuln\_processing\_cpu](#input\_vuln\_processing\_cpu) | The amount of CPU to dedicate to the vuln processing command | `number` | `1024` | no | -| [vuln\_processing\_memory](#input\_vuln\_processing\_memory) | The amount of memory to dedicate to the vuln processing command | `number` | `4096` | no | -| [vuln\_processing\_task\_cpu](#input\_vuln\_processing\_task\_cpu) | The amount of CPU to dedicate to the vuln processing task including sidecars | `number` | `1024` | no | -| [vuln\_processing\_task\_memory](#input\_vuln\_processing\_task\_memory) | The amount of memory to dedicate to the vuln processing task including sidecars | `number` | `4096` | no | - -## Outputs - -| Name | Description | -|------|-------------| -| [extra\_environment\_variables](#output\_extra\_environment\_variables) | n/a | -| [vuln\_service\_arn](#output\_vuln\_service\_arn) | n/a | diff --git a/terraform/addons/external-vuln-scans/main.tf b/terraform/addons/external-vuln-scans/main.tf deleted file mode 100644 index e38514e44872..000000000000 --- a/terraform/addons/external-vuln-scans/main.tf +++ /dev/null @@ -1,137 +0,0 @@ -data "aws_region" "current" {} - -locals { - environment = [ - // specifically overriding disable schedule here because the output of this module sets this to true - // and then we pull in the output of fleet ecs module - for k, v in merge( - var.fleet_config.extra_environment_variables, - { FLEET_VULNERABILITIES_DISABLE_SCHEDULE = "false" } - ) : { - name = k - value = v - } - ] - secrets = [ - for k, v in merge(var.fleet_config.extra_secrets, { - FLEET_MYSQL_PASSWORD = var.fleet_config.database.password_secret_arn - FLEET_MYSQL_READ_REPLICA_PASSWORD = var.fleet_config.database.password_secret_arn - FLEET_SERVER_PRIVATE_KEY = var.fleet_server_private_key_secret_arn - }) : { - name = k - valueFrom = v - } - ] - repository_credentials = var.fleet_config.repository_credentials != "" ? { - repositoryCredentials = { - credentialsParameter = var.fleet_config.repository_credentials - } - } : null -} - -resource "aws_ecs_service" "fleet" { - name = "${var.fleet_config.service.name}-vuln-processing" - launch_type = "FARGATE" - cluster = var.ecs_cluster - task_definition = aws_ecs_task_definition.vuln-processing.arn - desired_count = 1 - deployment_minimum_healthy_percent = 100 - deployment_maximum_percent = 200 - - lifecycle { - ignore_changes = [desired_count] - } - - network_configuration { - subnets = var.subnets - security_groups = var.security_groups - } -} - -resource "aws_ecs_task_definition" "vuln-processing" { - family = "${var.fleet_config.family}-vuln-processing" - cpu = var.vuln_processing_task_cpu - memory = var.vuln_processing_task_memory - execution_role_arn = var.execution_iam_role_arn - task_role_arn = var.task_role_arn - network_mode = "awsvpc" - pid_mode = var.fleet_config.pid_mode - requires_compatibilities = ["FARGATE"] - - container_definitions = jsonencode(concat([ - { - name = "fleet-vuln-processing" - image = var.fleet_config.image - cpu = var.vuln_processing_cpu - memory = var.vuln_processing_memory - essential = true - networkMode = "awsvpc" - secrets = local.secrets - repositoryCredentials = local.repository_credentials - ulimits = [ - { - name = "nofile" - softLimit = 999999 - hardLimit = 999999 - } - ], - environment = concat([ - { - name = "FLEET_MYSQL_USERNAME" - value = var.fleet_config.database.user - }, - { - name = "FLEET_MYSQL_DATABASE" - value = var.fleet_config.database.database - }, - { - name = "FLEET_MYSQL_ADDRESS" - value = var.fleet_config.database.address - }, - { - name = "FLEET_MYSQL_READ_REPLICA_USERNAME" - value = var.fleet_config.database.user - }, - { - name = "FLEET_MYSQL_READ_REPLICA_DATABASE" - value = var.fleet_config.database.database - }, - { - name = "FLEET_MYSQL_READ_REPLICA_ADDRESS" - value = var.fleet_config.database.rr_address == null ? var.fleet_config.database.address : var.fleet_config.database.rr_address - }, - { - name = "FLEET_REDIS_ADDRESS" - value = var.fleet_config.redis.address - }, - { - name = "FLEET_REDIS_USE_TLS" - value = tostring(var.fleet_config.redis.use_tls) - }, - { - name = "FLEET_SERVER_TLS" - value = "false" - }, - { - name = "FLEET_S3_SOFTWARE_INSTALLERS_BUCKET" - value = var.fleet_s3_software_installers_config.bucket_name - }, - { - name = "FLEET_S3_SOFTWARE_INSTALLERS_PREFIX" - value = var.fleet_s3_software_installers_config.s3_object_prefix - }, - ], local.environment), - logConfiguration = { - logDriver = "awslogs" - options = { - awslogs-group = var.awslogs_config.group - awslogs-region = var.awslogs_config.region == null ? data.aws_region.current.name : var.awslogs_config.region - awslogs-stream-prefix = "${var.awslogs_config.prefix}-vuln-processing" - } - } - }] - , var.fleet_config.sidecars)) -} - - - diff --git a/terraform/addons/external-vuln-scans/outputs.tf b/terraform/addons/external-vuln-scans/outputs.tf deleted file mode 100644 index 913a55da7225..000000000000 --- a/terraform/addons/external-vuln-scans/outputs.tf +++ /dev/null @@ -1,9 +0,0 @@ -output "extra_environment_variables" { - value = { - FLEET_VULNERABILITIES_DISABLE_SCHEDULE = "true" - } -} - -output "vuln_service_arn" { - value = aws_ecs_service.fleet.id -} diff --git a/terraform/addons/external-vuln-scans/variables.tf b/terraform/addons/external-vuln-scans/variables.tf deleted file mode 100644 index 03f2a4d4717e..000000000000 --- a/terraform/addons/external-vuln-scans/variables.tf +++ /dev/null @@ -1,76 +0,0 @@ -variable "ecs_cluster" { - description = "The ecs cluster module that is created by the byo-db module" -} - -variable "fleet_config" { - description = "The root Fleet config object" - type = any -} - -variable "awslogs_config" { - type = object({ - group = string - region = string - prefix = string - }) -} - -variable "subnets" { - type = list(string) - nullable = false -} - -variable "security_groups" { - type = list(string) - nullable = false -} - - -variable "customer_prefix" { - type = string - default = "fleet" -} - -variable "fleet_s3_software_installers_config" { - type = map(string) - description = "use the output of the byo-vpc module with the same name" -} - -variable "fleet_server_private_key_secret_arn" { - type = string - description = "The ARN of the secret that stores the Fleet private key" -} - -variable "execution_iam_role_arn" { - description = "The ARN of the fleet execution role, this is necessary to pass role from ecs events" -} - -variable "task_role_arn" { - description = "The ARN of the fleet task role, this is necessary to pass role from ecs events" -} - -variable "vuln_processing_task_memory" { - // note must conform to FARGATE breakpoints https://docs.aws.amazon.com/AmazonECS/latest/userguide/fargate-task-defs.html - default = 4096 - description = "The amount of memory to dedicate to the vuln processing task including sidecars" -} - -variable "vuln_processing_task_cpu" { - // note must conform to FARGETE breakpoints https://docs.aws.amazon.com/AmazonECS/latest/userguide/fargate-task-defs.html - default = 1024 - description = "The amount of CPU to dedicate to the vuln processing task including sidecars" -} - - -variable "vuln_processing_memory" { - // note must conform to FARGATE breakpoints https://docs.aws.amazon.com/AmazonECS/latest/userguide/fargate-task-defs.html - default = 4096 - description = "The amount of memory to dedicate to the vuln processing command" -} - -variable "vuln_processing_cpu" { - // note must conform to FARGETE breakpoints https://docs.aws.amazon.com/AmazonECS/latest/userguide/fargate-task-defs.html - default = 1024 - description = "The amount of CPU to dedicate to the vuln processing command" -} - diff --git a/terraform/addons/geolite2/.header.md b/terraform/addons/geolite2/.header.md deleted file mode 100644 index 89585fd96b24..000000000000 --- a/terraform/addons/geolite2/.header.md +++ /dev/null @@ -1,9 +0,0 @@ -# Geoip Terraform module for Fleet - -This module adds Geoip data to the Fleet docker image for use with the Fleet Terraform module. - -See the [documentation](https://fleetdm.com/docs/configuration/fleet-server-configuration#geoip) for some basic information about what happens under the hood. - -You will need to supply a Maxmind license key and a destination docker registry (such as ECR) to hold the new image. - -Outputs will be added to the environment variables in Fleet via the `extra_environment_variables` list. diff --git a/terraform/addons/geolite2/.terraform-docs.yml b/terraform/addons/geolite2/.terraform-docs.yml deleted file mode 100644 index 1d139ddb401d..000000000000 --- a/terraform/addons/geolite2/.terraform-docs.yml +++ /dev/null @@ -1 +0,0 @@ -header-from: .header.md diff --git a/terraform/addons/geolite2/Dockerfile b/terraform/addons/geolite2/Dockerfile deleted file mode 100644 index 0f401cc461e4..000000000000 --- a/terraform/addons/geolite2/Dockerfile +++ /dev/null @@ -1,17 +0,0 @@ -ARG FLEET_IMAGE - -FROM ${FLEET_IMAGE} - -ARG LICENSE_KEY -USER root - -RUN mkdir -p /opt/GeoLite2 && cd /opt/GeoLite2 &&\ - wget --max-redirect 10 "https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-City&license_key=${LICENSE_KEY}&suffix=tar.gz" -O GeoLite2-City.tar.gz &&\ - wget --max-redirect 10 "https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-City&license_key=${LICENSE_KEY}&suffix=tar.gz.sha256" -O GeoLite2-City.tar.gz.sha256 &&\ - [ "$(awk '{ print $1 }' GeoLite2-City.tar.gz.sha256)" == "$(sha256sum GeoLite2-City.tar.gz | awk '{ print $1 }')" ] &&\ - (tar -xzvf GeoLite2-City.tar.gz "*/GeoLite2-City.mmdb" --strip-components 1 2>/dev/null || true) &&\ - rm -f GeoLite2-City.tar.gz* - -USER fleet -# Might not be needed again, but keep it just in case -CMD ["fleet", "serve"] diff --git a/terraform/addons/geolite2/README.md b/terraform/addons/geolite2/README.md deleted file mode 100644 index 47c93f1da281..000000000000 --- a/terraform/addons/geolite2/README.md +++ /dev/null @@ -1,48 +0,0 @@ -# Geoip Terraform module for Fleet - -This module adds Geoip data to the Fleet docker image for use with the Fleet Terraform module. - -See the [documentation](https://fleetdm.com/docs/configuration/fleet-server-configuration#geoip) for some basic information about what happens under the hood. - -You will need to supply a Maxmind license key and a destination docker registry (such as ECR) to hold the new image. - -Outputs will be added to the environment variables in Fleet via the `extra_environment_variables` list. - -## Requirements - -| Name | Version | -|------|---------| -| [docker](#requirement\_docker) | 3.0.2 | - -## Providers - -| Name | Version | -|------|---------| -| [docker](#provider\_docker) | 3.0.2 | -| [local](#provider\_local) | 2.4.1 | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [docker_image.maxmind_fleet](https://registry.terraform.io/providers/kreuzwerker/docker/3.0.2/docs/resources/image) | resource | -| [docker_registry_image.maxmind_fleet](https://registry.terraform.io/providers/kreuzwerker/docker/3.0.2/docs/resources/registry_image) | resource | -| [local_file.dockerfile](https://registry.terraform.io/providers/hashicorp/local/latest/docs/resources/file) | resource | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [destination\_image](#input\_destination\_image) | n/a | `string` | n/a | yes | -| [fleet\_image](#input\_fleet\_image) | n/a | `string` | n/a | yes | -| [license\_key](#input\_license\_key) | n/a | `string` | n/a | yes | - -## Outputs - -| Name | Description | -|------|-------------| -| [extra\_environment\_variables](#output\_extra\_environment\_variables) | n/a | diff --git a/terraform/addons/geolite2/main.tf b/terraform/addons/geolite2/main.tf deleted file mode 100644 index aef0baebedff..000000000000 --- a/terraform/addons/geolite2/main.tf +++ /dev/null @@ -1,32 +0,0 @@ -terraform { - required_providers { - docker = { - source = "kreuzwerker/docker" - version = "3.0.2" - } - } -} - -# Build the new image -resource "docker_image" "maxmind_fleet" { - name = var.destination_image - - build { - context = path.module - platform = "linux/amd64" - build_args = { - FLEET_IMAGE = var.fleet_image - LICENSE_KEY = var.license_key - } - pull_parent = true - } -} - -# push it to the specified repo -resource "docker_registry_image" "maxmind_fleet" { - triggers = { - fleet_digest = docker_image.maxmind_fleet.repo_digest - } - name = docker_image.maxmind_fleet.name - keep_remotely = true -} diff --git a/terraform/addons/geolite2/outputs.tf b/terraform/addons/geolite2/outputs.tf deleted file mode 100644 index 7c4e5d7ddb0d..000000000000 --- a/terraform/addons/geolite2/outputs.tf +++ /dev/null @@ -1,5 +0,0 @@ -output "extra_environment_variables" { - value = { - FLEET_GEOIP_DATABASE_PATH = "/opt/GeoLite2/GeoLite2-City.mmdb" - } -} diff --git a/terraform/addons/geolite2/variables.tf b/terraform/addons/geolite2/variables.tf deleted file mode 100644 index cae84fcbda47..000000000000 --- a/terraform/addons/geolite2/variables.tf +++ /dev/null @@ -1,11 +0,0 @@ -variable "fleet_image" { - type = string -} - -variable "destination_image" { - type = string -} - -variable "license_key" { - type = string -} diff --git a/terraform/addons/logging-alb/.header.md b/terraform/addons/logging-alb/.header.md deleted file mode 100644 index 31d566b0ba95..000000000000 --- a/terraform/addons/logging-alb/.header.md +++ /dev/null @@ -1,46 +0,0 @@ -# ALB Logging Addon -This addon creates alb logging bucket(s) in s3 and optionally an athena database for those logs. - -# Example Configuration - -This assumes your fleet module is `main` and is configured with it's default documentation. - -See https://github.com/fleetdm/fleet/blob/main/terraform/example/main.tf for details. - -``` -module "main" { - source = "github.com/fleetdm/fleet//terraform?ref=main" - certificate_arn = module.acm.acm_certificate_arn - vpc = { - name = random_pet.main.id - } - fleet_config = { - extra_environment_variables = module.firehose-logging.fleet_extra_environment_variables - extra_iam_policies = module.firehose-logging.fleet_extra_iam_policies - } - alb_config = { - access_logs = { - bucket = module.logging_alb.log_s3_bucket_id - prefix = "fleet" - enabled = true - } - } -} - -module "logging_alb" { - source = "github.com/fleetdm/fleet//terraform/addons/logging-alb?ref=main" - prefix = "fleet" - enable_athena = true -} -``` - -# Additional Information - -Once this terraform is applied, the Athena table will need to be created. See https://docs.aws.amazon.com/athena/latest/ug/application-load-balancer-logs.html for help with creating the table. - -For this implementation, the S3 pattern for the `CREATE TABLE` query should look like this: - -``` -s3://your-alb-logs-bucket//AWSLogs//elasticloadbalancing// -``` - diff --git a/terraform/addons/logging-alb/.terraform-docs.yml b/terraform/addons/logging-alb/.terraform-docs.yml deleted file mode 100644 index 1d139ddb401d..000000000000 --- a/terraform/addons/logging-alb/.terraform-docs.yml +++ /dev/null @@ -1 +0,0 @@ -header-from: .header.md diff --git a/terraform/addons/logging-alb/README.md b/terraform/addons/logging-alb/README.md deleted file mode 100644 index e071b8da14d0..000000000000 --- a/terraform/addons/logging-alb/README.md +++ /dev/null @@ -1,96 +0,0 @@ -# ALB Logging Addon -This addon creates alb logging bucket(s) in s3 and optionally an athena database for those logs. - -# Example Configuration - -This assumes your fleet module is `main` and is configured with it's default documentation. - -See https://github.com/fleetdm/fleet/blob/main/terraform/example/main.tf for details. - -``` -module "main" { - source = "github.com/fleetdm/fleet//terraform?ref=main" - certificate_arn = module.acm.acm_certificate_arn - vpc = { - name = random_pet.main.id - } - fleet_config = { - extra_environment_variables = module.firehose-logging.fleet_extra_environment_variables - extra_iam_policies = module.firehose-logging.fleet_extra_iam_policies - } - alb_config = { - access_logs = { - bucket = module.logging_alb.log_s3_bucket_id - prefix = "fleet" - enabled = true - } - } -} - -module "logging_alb" { - source = "github.com/fleetdm/fleet//terraform/addons/logging-alb?ref=main" - prefix = "fleet" - enable_athena = true -} -``` - -# Additional Information - -Once this terraform is applied, the Athena table will need to be created. See https://docs.aws.amazon.com/athena/latest/ug/application-load-balancer-logs.html for help with creating the table. - -For this implementation, the S3 pattern for the `CREATE TABLE` query should look like this: - -``` -s3://your-alb-logs-bucket//AWSLogs//elasticloadbalancing// -``` - -## Requirements - -No requirements. - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | 5.25.0 | - -## Modules - -| Name | Source | Version | -|------|--------|---------| -| [athena-s3-bucket](#module\_athena-s3-bucket) | terraform-aws-modules/s3-bucket/aws | 3.15.1 | -| [s3\_bucket\_for\_logs](#module\_s3\_bucket\_for\_logs) | terraform-aws-modules/s3-bucket/aws | 3.15.1 | - -## Resources - -| Name | Type | -|------|------| -| [aws_athena_database.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/athena_database) | resource | -| [aws_athena_workgroup.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/athena_workgroup) | resource | -| [aws_kms_alias.logs_alias](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource | -| [aws_kms_key.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource | -| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | -| [aws_iam_policy_document.kms](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.s3_athena_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.s3_log_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [enable\_athena](#input\_enable\_athena) | n/a | `bool` | `true` | no | -| [extra\_kms\_policies](#input\_extra\_kms\_policies) | n/a | `list(any)` | `[]` | no | -| [extra\_s3\_athena\_policies](#input\_extra\_s3\_athena\_policies) | n/a | `list(any)` | `[]` | no | -| [extra\_s3\_log\_policies](#input\_extra\_s3\_log\_policies) | n/a | `list(any)` | `[]` | no | -| [prefix](#input\_prefix) | n/a | `string` | `"fleet"` | no | -| [s3\_expiration\_days](#input\_s3\_expiration\_days) | n/a | `number` | `90` | no | -| [s3\_newer\_noncurrent\_versions](#input\_s3\_newer\_noncurrent\_versions) | n/a | `number` | `5` | no | -| [s3\_noncurrent\_version\_expiration\_days](#input\_s3\_noncurrent\_version\_expiration\_days) | n/a | `number` | `30` | no | -| [s3\_transition\_days](#input\_s3\_transition\_days) | n/a | `number` | `30` | no | - -## Outputs - -| Name | Description | -|------|-------------| -| [log\_s3\_bucket\_id](#output\_log\_s3\_bucket\_id) | n/a | diff --git a/terraform/addons/logging-alb/main.tf b/terraform/addons/logging-alb/main.tf deleted file mode 100644 index 58437a12fbf2..000000000000 --- a/terraform/addons/logging-alb/main.tf +++ /dev/null @@ -1,255 +0,0 @@ -data "aws_caller_identity" "current" {} - -data "aws_region" "current" {} - -locals { - - kms_policies = concat([{ - actions = ["kms:*"], - principals = [{ - type = "AWS" - identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"] - }] - resources = ["*"] - - }, - { - actions = [ - "kms:Encrypt*", - "kms:Decrypt*", - "kms:ReEncrypt*", - "kms:GenerateDataKey*", - "kms:Describe*", - ] - resources = ["*"] - principals = [{ - type = "Service" - identifiers = ["logs.${data.aws_region.current.name}.amazonaws.com"] - }] - }], var.extra_kms_policies) - -} - - -data "aws_iam_policy_document" "kms" { - dynamic "statement" { - for_each = local.kms_policies - content { - sid = try(statement.value.sid, "") - actions = try(statement.value.actions, []) - resources = try(statement.value.resources, []) - effect = try(statement.value.effect, null) - dynamic "principals" { - for_each = try(statement.value.principals, []) - content { - type = principals.value.type - identifiers = principals.value.identifiers - } - } - dynamic "condition" { - for_each = try(statement.value.conditions, []) - content { - test = condition.value.test - variable = condition.value.variable - values = condition.value.values - } - } - } - } -} - -data "aws_iam_policy_document" "s3_log_bucket" { - count = var.extra_s3_log_policies == [] ? 0 : 1 - dynamic "statement" { - for_each = var.extra_s3_log_policies - content { - sid = try(statement.value.sid, "") - actions = try(statement.value.actions, []) - resources = try(statement.value.resources, []) - effect = try(statement.value.effect, null) - dynamic "principals" { - for_each = try(statement.value.principals, []) - content { - type = principals.value.type - identifiers = principals.value.identifiers - } - } - dynamic "condition" { - for_each = try(statement.value.conditions, []) - content { - test = condition.value.test - variable = condition.value.variable - values = condition.value.values - } - } - } - } -} - -data "aws_iam_policy_document" "s3_athena_bucket" { - count = var.extra_s3_athena_policies == [] ? 0 : 1 - dynamic "statement" { - for_each = var.extra_s3_athena_policies - content { - sid = try(statement.value.sid, "") - actions = try(statement.value.actions, []) - resources = try(statement.value.resources, []) - effect = try(statement.value.effect, null) - dynamic "principals" { - for_each = try(statement.value.principals, []) - content { - type = principals.value.type - identifiers = principals.value.identifiers - } - } - dynamic "condition" { - for_each = try(statement.value.conditions, []) - content { - test = condition.value.test - variable = condition.value.variable - values = condition.value.values - } - } - } - } -} - -resource "aws_kms_key" "logs" { - policy = data.aws_iam_policy_document.kms.json - enable_key_rotation = true -} - -resource "aws_kms_alias" "logs_alias" { - name_prefix = "alias/${var.prefix}-logs" - target_key_id = aws_kms_key.logs.id -} - -module "s3_bucket_for_logs" { - source = "terraform-aws-modules/s3-bucket/aws" - version = "3.15.1" - - bucket = "${var.prefix}-alb-logs" - - # Allow deletion of non-empty bucket - force_destroy = true - - attach_elb_log_delivery_policy = true # Required for ALB logs - attach_lb_log_delivery_policy = true # Required for ALB/NLB logs - attach_deny_insecure_transport_policy = true - attach_require_latest_tls_policy = true - attach_policy = var.extra_s3_log_policies != [] - policy = var.extra_s3_log_policies != [] ? data.aws_iam_policy_document.s3_log_bucket[0].json : null - block_public_acls = true - block_public_policy = true - ignore_public_acls = true - restrict_public_buckets = true - server_side_encryption_configuration = { - rule = { - bucket_key_enabled = true - apply_server_side_encryption_by_default = { - sse_algorithm = "AES256" - } - } - } - lifecycle_rule = [ - { - id = "log" - enabled = true - - transition = [ - { - days = var.s3_transition_days - storage_class = "ONEZONE_IA" - } - ] - expiration = { - days = var.s3_expiration_days - # Always resets to false anyhow showing terraform changes constantly - expired_object_delete_marker = false - } - noncurrent_version_expiration = { - newer_noncurrent_versions = var.s3_newer_noncurrent_versions - days = var.s3_noncurrent_version_expiration_days - } - } - ] -} - -resource "aws_athena_database" "logs" { - count = var.enable_athena == true ? 1 : 0 - name = replace("${var.prefix}-alb-logs", "-", "_") - bucket = module.athena-s3-bucket[0].s3_bucket_id -} - -module "athena-s3-bucket" { - count = var.enable_athena == true ? 1 : 0 - source = "terraform-aws-modules/s3-bucket/aws" - version = "3.15.1" - - bucket = "${var.prefix}-alb-logs-athena" - - # Allow deletion of non-empty bucket - force_destroy = true - - attach_elb_log_delivery_policy = true # Required for ALB logs - attach_lb_log_delivery_policy = true # Required for ALB/NLB logs - attach_deny_insecure_transport_policy = true - attach_require_latest_tls_policy = true - attach_policy = var.extra_s3_athena_policies != [] - policy = var.extra_s3_athena_policies != [] ? data.aws_iam_policy_document.s3_athena_bucket[0].json : null - block_public_acls = true - block_public_policy = true - ignore_public_acls = true - restrict_public_buckets = true - server_side_encryption_configuration = { - rule = { - apply_server_side_encryption_by_default = { - kms_master_key_id = aws_kms_key.logs.arn - sse_algorithm = "aws:kms" - } - } - } - lifecycle_rule = [ - { - id = "log" - enabled = true - - transition = [ - { - days = var.s3_transition_days - storage_class = "ONEZONE_IA" - } - ] - expiration = { - days = var.s3_expiration_days - # Always resets to false anyhow showing terraform changes constantly - expired_object_delete_marker = false - } - noncurrent_version_expiration = { - newer_noncurrent_versions = var.s3_newer_noncurrent_versions - days = var.s3_noncurrent_version_expiration_days - } - } - ] -} - -resource "aws_athena_workgroup" "logs" { - count = var.enable_athena == true ? 1 : 0 - name = "${var.prefix}-logs" - - configuration { - enforce_workgroup_configuration = true - publish_cloudwatch_metrics_enabled = true - - result_configuration { - output_location = "s3://${module.athena-s3-bucket[0].s3_bucket_id}/output/" - - encryption_configuration { - encryption_option = "SSE_KMS" - kms_key_arn = aws_kms_key.logs.arn - } - } - } - - force_destroy = true -} diff --git a/terraform/addons/logging-alb/outputs.tf b/terraform/addons/logging-alb/outputs.tf deleted file mode 100644 index df11006e44b6..000000000000 --- a/terraform/addons/logging-alb/outputs.tf +++ /dev/null @@ -1,3 +0,0 @@ -output "log_s3_bucket_id" { - value = module.s3_bucket_for_logs.s3_bucket_id -} diff --git a/terraform/addons/logging-alb/variables.tf b/terraform/addons/logging-alb/variables.tf deleted file mode 100644 index 4de3f80a8bb9..000000000000 --- a/terraform/addons/logging-alb/variables.tf +++ /dev/null @@ -1,44 +0,0 @@ -variable "prefix" { - type = string - default = "fleet" -} - -variable "enable_athena" { - type = bool - default = true -} - -variable "s3_transition_days" { - type = number - default = 30 -} - -variable "s3_expiration_days" { - type = number - default = 90 -} - -variable "s3_newer_noncurrent_versions" { - type = number - default = 5 -} - -variable "s3_noncurrent_version_expiration_days" { - type = number - default = 30 -} - -variable "extra_kms_policies" { - type = list(any) - default = [] -} - -variable "extra_s3_log_policies" { - type = list(any) - default = [] -} - -variable "extra_s3_athena_policies" { - type = list(any) - default = [] -} diff --git a/terraform/addons/logging-destination-firehose/.header.md b/terraform/addons/logging-destination-firehose/.header.md deleted file mode 100644 index a49839623388..000000000000 --- a/terraform/addons/logging-destination-firehose/.header.md +++ /dev/null @@ -1,2 +0,0 @@ -# Logging Destination: Firehose -This addon provides a Kinesis Firehose logging destination for Fleet. diff --git a/terraform/addons/logging-destination-firehose/.terraform-docs.yml b/terraform/addons/logging-destination-firehose/.terraform-docs.yml deleted file mode 100644 index 1d139ddb401d..000000000000 --- a/terraform/addons/logging-destination-firehose/.terraform-docs.yml +++ /dev/null @@ -1 +0,0 @@ -header-from: .header.md diff --git a/terraform/addons/logging-destination-firehose/.terraform.lock.hcl b/terraform/addons/logging-destination-firehose/.terraform.lock.hcl deleted file mode 100644 index 3d971a357d8d..000000000000 --- a/terraform/addons/logging-destination-firehose/.terraform.lock.hcl +++ /dev/null @@ -1,24 +0,0 @@ -# This file is maintained automatically by "terraform init". -# Manual edits may be lost in future updates. - -provider "registry.terraform.io/hashicorp/aws" { - version = "5.44.0" - hashes = [ - "h1:QqMTKuyylmJ633mwNheXdFupfd5sozqCUTTSj89pnm8=", - "zh:1224a42bb04574785549b89815d98bda11f6e9992352fc6c36c5622f3aea91c0", - "zh:2a8d1095a2f1ab097f516d9e7e0d289337849eebb3fcc34f075070c65063f4fa", - "zh:46cce11150eb4934196d9bff693b72d0494c85917ceb3c2914d5ff4a785af861", - "zh:4a7c15d585ee747d17f4b3904851cd95cfbb920fa197aed3df78e8d7ef9609b6", - "zh:508f1a85a0b0f93bf26341207d809bd55b60c8fdeede40097d91f30111fc6f5d", - "zh:52f968ffc21240213110378d0ffb298cbd23e9157a6d01dfac5a4360492d69c2", - "zh:5e9846b48ef03eb59541049e81b15cae8bc7696a3779ae4a5412fdce60bb24e0", - "zh:850398aecaf7dc0231fc320fdd6dffe41836e07a54c8c7b40eb28e7525d3c0a9", - "zh:8f87eeb05bdd1b873b6cfb3898dfad6402ac180dfa3c8f9754df8f85dcf92ca6", - "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", - "zh:c726b87cd6ed111536f875dccedecff21abc802a4087264515ffab113cac36dc", - "zh:d57ea706d2f98b93c7b05b0c6bc3420de8e8cf2d0b6703085dc15ed239b2cc49", - "zh:d5d1a21246e68c2a7a04c5619eb0ad5a81644f644c432cb690537b816a156de2", - "zh:e869904cac41114b7e4ee66bcd2ce4585ed15ca842040a60cb47119f69472c91", - "zh:f1a09f2f3ea72cbe795b865cf31ad9b1866a536a8050cf0bb93d3fa51069582e", - ] -} diff --git a/terraform/addons/logging-destination-firehose/README.md b/terraform/addons/logging-destination-firehose/README.md deleted file mode 100644 index 054cc69b3a89..000000000000 --- a/terraform/addons/logging-destination-firehose/README.md +++ /dev/null @@ -1,58 +0,0 @@ -# Logging Destination: Firehose -This addon provides a Kinesis Firehose logging destination for Fleet. - -## Requirements - -No requirements. - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | 5.44.0 | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [aws_iam_policy.firehose-logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | -| [aws_iam_policy.firehose-results](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | -| [aws_iam_policy.firehose-status](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | -| [aws_iam_role.firehose-results](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | -| [aws_iam_role.firehose-status](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | -| [aws_iam_role_policy_attachment.firehose-results](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | -| [aws_iam_role_policy_attachment.firehose-status](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | -| [aws_kinesis_firehose_delivery_stream.osquery_results](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_firehose_delivery_stream) | resource | -| [aws_kinesis_firehose_delivery_stream.osquery_status](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kinesis_firehose_delivery_stream) | resource | -| [aws_s3_bucket.osquery-results](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource | -| [aws_s3_bucket.osquery-status](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource | -| [aws_s3_bucket_lifecycle_configuration.osquery-results](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource | -| [aws_s3_bucket_lifecycle_configuration.osquery-status](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource | -| [aws_s3_bucket_public_access_block.osquery-results](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource | -| [aws_s3_bucket_public_access_block.osquery-status](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource | -| [aws_s3_bucket_server_side_encryption_configuration.osquery-results](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource | -| [aws_s3_bucket_server_side_encryption_configuration.osquery-status](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource | -| [aws_iam_policy_document.firehose-logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.osquery_firehose_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.osquery_results_policy_doc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.osquery_status_policy_doc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [compression\_format](#input\_compression\_format) | n/a | `string` | `"UNCOMPRESSED"` | no | -| [osquery\_results\_s3\_bucket](#input\_osquery\_results\_s3\_bucket) | n/a | 
object({
    name         = optional(string, "fleet-osquery-results-archive")
    expires_days = optional(number, 1)
  })
| 
{
  "expires_days": 1,
  "name": "fleet-osquery-results-archive"
}
| no | -| [osquery\_status\_s3\_bucket](#input\_osquery\_status\_s3\_bucket) | n/a | 
object({
    name         = optional(string, "fleet-osquery-status-archive")
    expires_days = optional(number, 1)
  })
| 
{
  "expires_days": 1,
  "name": "fleet-osquery-status-archive"
}
| no | - -## Outputs - -| Name | Description | -|------|-------------| -| [fleet\_extra\_environment\_variables](#output\_fleet\_extra\_environment\_variables) | n/a | -| [fleet\_extra\_iam\_policies](#output\_fleet\_extra\_iam\_policies) | n/a | diff --git a/terraform/addons/logging-destination-firehose/main.tf b/terraform/addons/logging-destination-firehose/main.tf deleted file mode 100644 index fcefd188de70..000000000000 --- a/terraform/addons/logging-destination-firehose/main.tf +++ /dev/null @@ -1,185 +0,0 @@ -// Customer keys are not supported in our Fleet Terraforms at the moment. We will evaluate the -// possibility of providing this capability in the future. -// No versioning on this bucket is by design. -// Bucket logging is not supported in our Fleet Terraforms at the moment. It can be enabled by the -// organizations deploying Fleet, and we will evaluate the possibility of providing this capability -// in the future. - -data "aws_region" "current" {} - -resource "aws_s3_bucket" "osquery-results" { #tfsec:ignore:aws-s3-encryption-customer-key:exp:2022-07-01 #tfsec:ignore:aws-s3-enable-versioning #tfsec:ignore:aws-s3-enable-bucket-logging:exp:2022-06-15 - bucket = var.osquery_results_s3_bucket.name -} - -resource "aws_s3_bucket_lifecycle_configuration" "osquery-results" { - bucket = aws_s3_bucket.osquery-results.bucket - rule { - status = "Enabled" - id = "expire" - expiration { - days = var.osquery_results_s3_bucket.expires_days - } - } -} - -resource "aws_s3_bucket_server_side_encryption_configuration" "osquery-results" { - bucket = aws_s3_bucket.osquery-results.bucket - rule { - apply_server_side_encryption_by_default { - sse_algorithm = "aws:kms" - } - } -} - -resource "aws_s3_bucket_public_access_block" "osquery-results" { - bucket = aws_s3_bucket.osquery-results.id - block_public_acls = true - block_public_policy = true - ignore_public_acls = true - restrict_public_buckets = true -} - -// Customer keys are not supported in our Fleet Terraforms at the moment. We will evaluate the -// possibility of providing this capability in the future. -// No versioning on this bucket is by design. -// Bucket logging is not supported in our Fleet Terraforms at the moment. It can be enabled by the -// organizations deploying Fleet, and we will evaluate the possibility of providing this capability -// in the future. -resource "aws_s3_bucket" "osquery-status" { #tfsec:ignore:aws-s3-encryption-customer-key:exp:2022-07-01 #tfsec:ignore:aws-s3-enable-versioning #tfsec:ignore:aws-s3-enable-bucket-logging:exp:2022-06-15 - bucket = var.osquery_status_s3_bucket.name -} - -resource "aws_s3_bucket_lifecycle_configuration" "osquery-status" { - bucket = aws_s3_bucket.osquery-status.bucket - rule { - status = "Enabled" - id = "expire" - expiration { - days = var.osquery_status_s3_bucket.expires_days - } - } -} - -resource "aws_s3_bucket_server_side_encryption_configuration" "osquery-status" { - bucket = aws_s3_bucket.osquery-status.bucket - rule { - apply_server_side_encryption_by_default { - sse_algorithm = "aws:kms" - } - } -} - -resource "aws_s3_bucket_public_access_block" "osquery-status" { - bucket = aws_s3_bucket.osquery-status.id - block_public_acls = true - block_public_policy = true - ignore_public_acls = true - restrict_public_buckets = true -} - -data "aws_iam_policy_document" "osquery_results_policy_doc" { - statement { - effect = "Allow" - actions = [ - "s3:AbortMultipartUpload", - "s3:GetBucketLocation", - "s3:ListBucket", - "s3:ListBucketMultipartUploads", - "s3:PutObject" - ] - // This bucket is single-purpose and using a wildcard is not problematic - resources = [aws_s3_bucket.osquery-results.arn, "${aws_s3_bucket.osquery-results.arn}/*"] #tfsec:ignore:aws-iam-no-policy-wildcards - } -} - -data "aws_iam_policy_document" "osquery_status_policy_doc" { - statement { - effect = "Allow" - actions = [ - "s3:AbortMultipartUpload", - "s3:GetBucketLocation", - "s3:ListBucket", - "s3:ListBucketMultipartUploads", - "s3:PutObject" - ] - // This bucket is single-purpose and using a wildcard is not problematic - resources = [aws_s3_bucket.osquery-status.arn, "${aws_s3_bucket.osquery-status.arn}/*"] #tfsec:ignore:aws-iam-no-policy-wildcards - } -} - -resource "aws_iam_policy" "firehose-results" { - name = "osquery_results_firehose_policy" - policy = data.aws_iam_policy_document.osquery_results_policy_doc.json -} - -resource "aws_iam_policy" "firehose-status" { - name = "osquery_status_firehose_policy" - policy = data.aws_iam_policy_document.osquery_status_policy_doc.json -} - -resource "aws_iam_role" "firehose-results" { - assume_role_policy = data.aws_iam_policy_document.osquery_firehose_assume_role.json -} - -resource "aws_iam_role" "firehose-status" { - assume_role_policy = data.aws_iam_policy_document.osquery_firehose_assume_role.json -} - -resource "aws_iam_role_policy_attachment" "firehose-results" { - policy_arn = aws_iam_policy.firehose-results.arn - role = aws_iam_role.firehose-results.name -} - -resource "aws_iam_role_policy_attachment" "firehose-status" { - policy_arn = aws_iam_policy.firehose-status.arn - role = aws_iam_role.firehose-status.name -} - -data "aws_iam_policy_document" "osquery_firehose_assume_role" { - statement { - effect = "Allow" - actions = ["sts:AssumeRole"] - principals { - identifiers = ["firehose.amazonaws.com"] - type = "Service" - } - } -} - -resource "aws_kinesis_firehose_delivery_stream" "osquery_results" { - name = var.osquery_results_s3_bucket.name - destination = "extended_s3" - - extended_s3_configuration { - compression_format = var.compression_format - role_arn = aws_iam_role.firehose-results.arn - bucket_arn = aws_s3_bucket.osquery-results.arn - } -} - -resource "aws_kinesis_firehose_delivery_stream" "osquery_status" { - name = var.osquery_status_s3_bucket.name - destination = "extended_s3" - - extended_s3_configuration { - compression_format = var.compression_format - role_arn = aws_iam_role.firehose-status.arn - bucket_arn = aws_s3_bucket.osquery-status.arn - } -} - -data "aws_iam_policy_document" "firehose-logging" { - statement { - actions = [ - "firehose:DescribeDeliveryStream", - "firehose:PutRecord", - "firehose:PutRecordBatch", - ] - resources = [aws_kinesis_firehose_delivery_stream.osquery_results.arn, aws_kinesis_firehose_delivery_stream.osquery_status.arn] - } -} - -resource "aws_iam_policy" "firehose-logging" { - description = "An IAM policy for fleet to log to Firehose destinations" - policy = data.aws_iam_policy_document.firehose-logging.json -} diff --git a/terraform/addons/logging-destination-firehose/outputs.tf b/terraform/addons/logging-destination-firehose/outputs.tf deleted file mode 100644 index a12dbc895174..000000000000 --- a/terraform/addons/logging-destination-firehose/outputs.tf +++ /dev/null @@ -1,15 +0,0 @@ -output "fleet_extra_environment_variables" { - value = { - FLEET_FIREHOSE_STATUS_STREAM = aws_kinesis_firehose_delivery_stream.osquery_status.name - FLEET_FIREHOSE_RESULT_STREAM = aws_kinesis_firehose_delivery_stream.osquery_results.name - FLEET_FIREHOSE_REGION = data.aws_region.current.name - FLEET_OSQUERY_STATUS_LOG_PLUGIN = "firehose" - FLEET_OSQUERY_RESULT_LOG_PLUGIN = "firehose" - } -} - -output "fleet_extra_iam_policies" { - value = [ - aws_iam_policy.firehose-logging.arn - ] -} diff --git a/terraform/addons/logging-destination-firehose/variables.tf b/terraform/addons/logging-destination-firehose/variables.tf deleted file mode 100644 index c97e2c36f692..000000000000 --- a/terraform/addons/logging-destination-firehose/variables.tf +++ /dev/null @@ -1,25 +0,0 @@ -variable "osquery_results_s3_bucket" { - type = object({ - name = optional(string, "fleet-osquery-results-archive") - expires_days = optional(number, 1) - }) - default = { - name = "fleet-osquery-results-archive" - expires_days = 1 - } -} - -variable "osquery_status_s3_bucket" { - type = object({ - name = optional(string, "fleet-osquery-status-archive") - expires_days = optional(number, 1) - }) - default = { - name = "fleet-osquery-status-archive" - expires_days = 1 - } -} - -variable "compression_format" { - default = "UNCOMPRESSED" -} diff --git a/terraform/addons/mdm/.header.md b/terraform/addons/mdm/.header.md deleted file mode 100644 index 021a89549c8f..000000000000 --- a/terraform/addons/mdm/.header.md +++ /dev/null @@ -1,51 +0,0 @@ -# MDM addon - -Notice: Previous versions of this module referred to `dep`, but to reduce confusion that has been replaces with `abm` -to mach the change to the newer Apple Busines Manager. For each key/value pair below, the key names have been changed -from previous version to match the name of the env var for easier usability. Older unused env vars were also removed -for simplification. This includes removing the need for `extra_environment_variables` completely. - -This addon enables MDM functionality for Fleet. It does this via several secrets in AWS that stores the necessary values. -The following secrets are created: -- abm -- scep -- apn - -Note: ABM is optional. If Apple Business Manager (ABM) is not used, set the abm variable to `null` and it will be omitted. - -Since this module cannot determine the value for the secrets at apply time, this module must be applied in 2 phases: - -1. In the first phase, just add the module without passing additional config to the main Fleet module -1. In the second phase, after the secret values have been populated, apply while also passing the additional config to the main Fleet module. - -The secrets should have the following layouts, note that all values are strings. If a value is a JSON object, string escape it.: -## ABM -``` -{ - "FLEET_MDM_APPLE_BM_CERT_BYTES": , - "FLEET_MDM_APPLE_BM_KEY_BYTES": , - "FLEET_MDM_APPLE_BM_SERVER_TOKEN_BYTES": -} -``` - -## SCEP -``` -{ - "FLEET_MDM_APPLE_SCEP_CERT_BYTES": , - "FLEET_MDM_APPLE_SCEP_KEY_BYTES": , - "FLEET_MDM_APPLE_SCEP_CHALLENGE": -} -``` - -Please note that for Windows, the same SCEP cert is used and the cert+key above will populate the following environment variables: -``` - "FLEET_MDM_WINDOWS_WSTEP_IDENTITY_CERT_BYTES" - "FLEET_MDM_WINDOWS_WSTEP_IDENTITY_KEY_BYTES" -``` -## APN -``` -{ - "FLEET_MDM_APPLE_APNS_CERT_BYTES": , - "FLEET_MDM_APPLE_APNS_KEY_BYTES ": -} -``` diff --git a/terraform/addons/mdm/.terraform-docs.yml b/terraform/addons/mdm/.terraform-docs.yml deleted file mode 100644 index 1d139ddb401d..000000000000 --- a/terraform/addons/mdm/.terraform-docs.yml +++ /dev/null @@ -1 +0,0 @@ -header-from: .header.md diff --git a/terraform/addons/mdm/.terraform.lock.hcl b/terraform/addons/mdm/.terraform.lock.hcl deleted file mode 100644 index 380e800129a2..000000000000 --- a/terraform/addons/mdm/.terraform.lock.hcl +++ /dev/null @@ -1,25 +0,0 @@ -# This file is maintained automatically by "terraform init". -# Manual edits may be lost in future updates. - -provider "registry.terraform.io/hashicorp/aws" { - version = "4.53.0" - hashes = [ - "h1:CymaUpULY6LR/rHl+4+Vs0i2jVHXMhSZuJj8VXqGIPs=", - "h1:P6ZZ716SRIimw0t/SAgYbOMZtO0HDvwVQKxyHEW6aaE=", - "zh:0d44171544a916adf0fa96b7d0851a49d8dec98f71f0229dfd2d178958b3996b", - "zh:16945808ce26b86af7f5a77c4ab1154da786208c793abb95b8f918b4f48daded", - "zh:1a57a5a30cef9a5867579d894b74f60bb99afc7ca0d030d49a80ad776958b428", - "zh:2c718734ae17430d7f598ca0b4e4f86d43d66569c72076a10f4ace3ff8dfc605", - "zh:46fdf6301cb2fa0a4d122d1a8f75f047b6660c24851d6a4537ee38926a86485d", - "zh:53a53920b38a9e1648e85c6ee33bccf95bfcd067bffc4934a2af55621e6a6bd9", - "zh:548d927b234b1914c43169224b03f641d0961a4e312e5c6508657fce27b66db4", - "zh:57c847b2a5ae41ddea20b18ef006369d36bfdc4dec7f542f60e22a47f7b6f347", - "zh:79f7402b581621ba69f5a07ce70299735c678beb265d114d58955d04f0d39f87", - "zh:8970109a692dc4ecbda98a0969da472da4759db90ce22f2a196356ea85bb2cf7", - "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", - "zh:a500cc4ffcad854dec0cf6f97751930a53c9f278f143a4355fa8892aa77c77bf", - "zh:b687c20b42a8b9e9e9f56c42e3b3c6859c043ec72b8907a6e4d4b64068e11df5", - "zh:e2c592e96822b78287554be43c66398f658c74c4ae3796f6b9e6d4b0f1f7f626", - "zh:ff1c4a46fdc988716c6fc28925549600093fc098828237cb1a30264e15cf730f", - ] -} diff --git a/terraform/addons/mdm/README.md b/terraform/addons/mdm/README.md deleted file mode 100644 index 4acccf3d9bb9..000000000000 --- a/terraform/addons/mdm/README.md +++ /dev/null @@ -1,97 +0,0 @@ -# MDM addon - -Notice: Previous versions of this module referred to `dep`, but to reduce confusion that has been replaces with `abm` -to mach the change to the newer Apple Business Manager. For each key/value pair below, the key names have been changed -from previous version to match the name of the env var for easier usability. Older unused env vars were also removed -for simplification. This includes removing the need for `extra_environment_variables` completely. - -This addon enables MDM functionality for Fleet. It does this via several secrets in AWS that stores the necessary values. -The following secrets are created: -- abm -- scep -- apn - -Note: ABM is optional. If Apple Business Manager (ABM) is not used, set the abm variable to `null` and it will be omitted. - -Since this module cannot determine the value for the secrets at apply time, this module must be applied in 2 phases: - -1. In the first phase, just add the module without passing additional config to the main Fleet module -1. In the second phase, after the secret values have been populated, apply while also passing the additional config to the main Fleet module. - -The secrets should have the following layouts, note that all values are strings. If a value is a JSON object, string escape it.: -## ABM -``` -{ - "FLEET_MDM_APPLE_BM_CERT_BYTES": , - "FLEET_MDM_APPLE_BM_KEY_BYTES": , - "FLEET_MDM_APPLE_BM_SERVER_TOKEN_BYTES": -} -``` - -## SCEP -``` -{ - "FLEET_MDM_APPLE_SCEP_CERT_BYTES": , - "FLEET_MDM_APPLE_SCEP_KEY_BYTES": , - "FLEET_MDM_APPLE_SCEP_CHALLENGE": -} -``` - -Please note that for Windows, the same SCEP cert is used and the cert+key above will populate the following environment variables: -``` - "FLEET_MDM_WINDOWS_WSTEP_IDENTITY_CERT_BYTES" - "FLEET_MDM_WINDOWS_WSTEP_IDENTITY_KEY_BYTES" -``` -## APN -``` -{ - "FLEET_MDM_APPLE_APNS_CERT_BYTES": , - "FLEET_MDM_APPLE_APNS_KEY_BYTES ": -} -``` - -## Requirements - -No requirements. - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | 4.53.0 | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [aws_iam_policy.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | -| [aws_secretsmanager_secret.abm](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource | -| [aws_secretsmanager_secret.apn](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource | -| [aws_secretsmanager_secret.scep](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource | -| [aws_iam_policy_document.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [abm\_secret\_name](#input\_abm\_secret\_name) | n/a | `string` | `"fleet-abm"` | no | -| [apn\_secret\_name](#input\_apn\_secret\_name) | n/a | `string` | `"fleet-apn"` | no | -| [enable\_apple\_mdm](#input\_enable\_apple\_mdm) | n/a | `bool` | `true` | no | -| [enable\_windows\_mdm](#input\_enable\_windows\_mdm) | n/a | `bool` | `false` | no | -| [public\_domain\_name](#input\_public\_domain\_name) | n/a | `string` | n/a | yes | -| [scep\_secret\_name](#input\_scep\_secret\_name) | n/a | `string` | `"fleet-scep"` | no | - -## Outputs - -| Name | Description | -|------|-------------| -| [abm](#output\_abm) | n/a | -| [apn](#output\_apn) | n/a | -| [extra\_execution\_iam\_policies](#output\_extra\_execution\_iam\_policies) | n/a | -| [extra\_secrets](#output\_extra\_secrets) | n/a | -| [scep](#output\_scep) | n/a | diff --git a/terraform/addons/mdm/main.tf b/terraform/addons/mdm/main.tf deleted file mode 100644 index 845d9df8921d..000000000000 --- a/terraform/addons/mdm/main.tf +++ /dev/null @@ -1,43 +0,0 @@ -data "aws_region" "current" {} - -resource "aws_secretsmanager_secret" "apn" { - count = var.apn_secret_name == null ? 0 : 1 - name = var.apn_secret_name - - recovery_window_in_days = "0" - lifecycle { - create_before_destroy = true - } -} - -resource "aws_secretsmanager_secret" "scep" { - name = var.scep_secret_name - - recovery_window_in_days = "0" - lifecycle { - create_before_destroy = true - } -} - -resource "aws_secretsmanager_secret" "abm" { - count = var.abm_secret_name == null ? 0 : 1 - name = var.abm_secret_name - - recovery_window_in_days = "0" - lifecycle { - create_before_destroy = true - } -} - -data "aws_iam_policy_document" "main" { - statement { - actions = ["secretsmanager:GetSecretValue"] - resources = concat(var.enable_apple_mdm == false ? [] : [aws_secretsmanager_secret.apn[0].arn], - [aws_secretsmanager_secret.scep.arn], - var.abm_secret_name == null ? [] : [aws_secretsmanager_secret.abm[0].arn]) - } -} - -resource "aws_iam_policy" "main" { - policy = data.aws_iam_policy_document.main.json -} diff --git a/terraform/addons/mdm/outputs.tf b/terraform/addons/mdm/outputs.tf deleted file mode 100644 index 6a9eb716475c..000000000000 --- a/terraform/addons/mdm/outputs.tf +++ /dev/null @@ -1,34 +0,0 @@ -output "extra_secrets" { - value = merge(var.enable_apple_mdm == false ? {} : { - FLEET_MDM_APPLE_SCEP_CERT_BYTES = "${aws_secretsmanager_secret.scep.arn}:FLEET_MDM_APPLE_SCEP_CERT_BYTES::" - FLEET_MDM_APPLE_SCEP_KEY_BYTES = "${aws_secretsmanager_secret.scep.arn}:FLEET_MDM_APPLE_SCEP_KEY_BYTES::" - FLEET_MDM_APPLE_SCEP_CHALLENGE = "${aws_secretsmanager_secret.scep.arn}:FLEET_MDM_APPLE_SCEP_CHALLENGE::" - FLEET_MDM_APPLE_APNS_CERT_BYTES = "${aws_secretsmanager_secret.apn[0].arn}:FLEET_MDM_APPLE_APNS_CERT_BYTES::" - FLEET_MDM_APPLE_APNS_KEY_BYTES = "${aws_secretsmanager_secret.apn[0].arn}:FLEET_MDM_APPLE_APNS_KEY_BYTES::" - }, var.abm_secret_name == null || var.enable_apple_mdm == false ? {} : { - FLEET_MDM_APPLE_BM_SERVER_TOKEN_BYTES = "${aws_secretsmanager_secret.abm[0].arn}:FLEET_MDM_APPLE_BM_SERVER_TOKEN_BYTES::" - FLEET_MDM_APPLE_BM_CERT_BYTES = "${aws_secretsmanager_secret.abm[0].arn}:FLEET_MDM_APPLE_BM_CERT_BYTES::" - FLEET_MDM_APPLE_BM_KEY_BYTES = "${aws_secretsmanager_secret.abm[0].arn}:FLEET_MDM_APPLE_BM_KEY_BYTES::" - }, var.enable_windows_mdm == false ? {} : { - FLEET_MDM_WINDOWS_WSTEP_IDENTITY_CERT_BYTES = "${aws_secretsmanager_secret.scep.arn}:FLEET_MDM_APPLE_SCEP_CERT_BYTES::" - FLEET_MDM_WINDOWS_WSTEP_IDENTITY_KEY_BYTES = "${aws_secretsmanager_secret.scep.arn}:FLEET_MDM_APPLE_SCEP_KEY_BYTES::" - }) -} - -output "extra_execution_iam_policies" { - value = [ - aws_iam_policy.main.arn - ] -} - -output "scep" { - value = aws_secretsmanager_secret.scep -} - -output "abm" { - value = var.abm_secret_name == null ? null : aws_secretsmanager_secret.abm[0] -} - -output "apn" { - value = var.enable_apple_mdm == false ? null : aws_secretsmanager_secret.apn[0] -} diff --git a/terraform/addons/mdm/variables.tf b/terraform/addons/mdm/variables.tf deleted file mode 100644 index aeadae9471b8..000000000000 --- a/terraform/addons/mdm/variables.tf +++ /dev/null @@ -1,29 +0,0 @@ -variable "apn_secret_name" { - default = "fleet-apn" - nullable = true - type = string -} - -variable "scep_secret_name" { - default = "fleet-scep" - nullable = false - type = string -} - -variable "abm_secret_name" { - default = "fleet-abm" - nullable = true - type = string -} - -variable "enable_windows_mdm" { - default = false - nullable = false - type = bool -} - -variable "enable_apple_mdm" { - default = true - nullable = false - type = bool -} diff --git a/terraform/addons/mdmproxy/iam.tf b/terraform/addons/mdmproxy/iam.tf deleted file mode 100644 index a76f48b9fca1..000000000000 --- a/terraform/addons/mdmproxy/iam.tf +++ /dev/null @@ -1,56 +0,0 @@ -data "aws_iam_policy_document" "mdmproxy" { - statement { - effect = "Allow" - actions = ["cloudwatch:PutMetricData"] - resources = ["*"] - } - -} - -data "aws_iam_policy_document" "assume_role" { - statement { - effect = "Allow" - actions = ["sts:AssumeRole"] - principals { - identifiers = ["ecs.amazonaws.com", "ecs-tasks.amazonaws.com"] - type = "Service" - } - } -} - -data "aws_iam_policy_document" "mdm_execution" { - // allow fleet application to obtain the database password from secrets manager - statement { - effect = "Allow" - actions = ["secretsmanager:GetSecretValue"] - resources = [aws_secretsmanager_secret.mdmproxy.arn] - } -} - -resource "aws_iam_role_policy_attachment" "execution_extras" { - for_each = toset(var.config.extra_execution_iam_policies) - policy_arn = each.value - role = aws_iam_role.execution.name -} - -resource "aws_iam_policy" "execution" { - name = var.config.iam.execution.policy_name - description = "IAM policy that Fleet mdmproxy uses to define access to AWS resources" - policy = data.aws_iam_policy_document.mdm_execution.json -} - -resource "aws_iam_role_policy_attachment" "execution" { - policy_arn = aws_iam_policy.execution.arn - role = aws_iam_role.execution.name -} - -resource "aws_iam_role" "execution" { - name = var.config.iam.execution.name - description = "The execution role for the mdmproxy in ECS" - assume_role_policy = data.aws_iam_policy_document.assume_role.json -} - -resource "aws_iam_role_policy_attachment" "role_attachment" { - policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy" - role = aws_iam_role.execution.name -} diff --git a/terraform/addons/mdmproxy/main.tf b/terraform/addons/mdmproxy/main.tf deleted file mode 100644 index 5d4a7ca51a4c..000000000000 --- a/terraform/addons/mdmproxy/main.tf +++ /dev/null @@ -1,241 +0,0 @@ -data "aws_region" "current" {} - -locals { - mdmproxy_secrets = { - MDMPROXY_AUTH_TOKEN = var.config.auth_token - MDMPROXY_MIGRATE_UDIDS = join(" ", var.config.migrate_udids) - } -} - -resource "aws_security_group" "mdmproxy" { - count = var.config.networking.security_groups == null ? 1 : 0 - name = var.config.networking.security_group_name - description = "Fleet ECS Service Security Group" - vpc_id = var.vpc_id - egress { - description = "Egress to all" - from_port = 0 - to_port = 0 - protocol = "-1" - cidr_blocks = ["0.0.0.0/0"] - ipv6_cidr_blocks = ["::/0"] - } - ingress { - description = "Ingress only on container port" - from_port = 8080 - to_port = 8080 - protocol = "TCP" - cidr_blocks = var.config.networking.ingress_sources.cidr_blocks - ipv6_cidr_blocks = var.config.networking.ingress_sources.ipv6_cidr_blocks - security_groups = concat(var.config.networking.ingress_sources.security_groups, [aws_security_group.alb.id]) - prefix_list_ids = var.config.networking.ingress_sources.prefix_list_ids - } -} - -module "alb" { - source = "terraform-aws-modules/alb/aws" - version = "8.3.0" - - name = var.alb_config.name - - load_balancer_type = "application" - - vpc_id = var.vpc_id - subnets = var.alb_config.subnets - security_groups = concat(var.alb_config.security_groups, [aws_security_group.alb.id]) - access_logs = var.alb_config.access_logs - idle_timeout = var.alb_config.idle_timeout - - target_groups = concat([ - { - name = var.alb_config.name - backend_protocol = "HTTP" - backend_port = 80 - target_type = "ip" - health_check = { - path = "/healthz" - matcher = "200" - timeout = 10 - interval = 15 - healthy_threshold = 5 - unhealthy_threshold = 5 - } - } - ], var.alb_config.extra_target_groups) - - # Require TLS 1.2 as earlier versions are insecure - listener_ssl_policy_default = var.alb_config.tls_policy - - https_listeners = [ - { - port = 443 - protocol = "HTTPS" - certificate_arn = var.alb_config.certificate_arn - target_group_index = 0 - } - ] - - https_listener_rules = var.alb_config.https_listener_rules - - http_tcp_listeners = [ - { - port = 80 - protocol = "HTTP" - action_type = "redirect" - redirect = { - port = "443" - protocol = "HTTPS" - status_code = "HTTP_301" - } - } - ] -} - -resource "aws_security_group" "alb" { - #checkov:skip=CKV2_AWS_5:False positive - vpc_id = var.vpc_id - description = "Fleet-mdmproxy ALB Security Group" - ingress { - description = "Ingress from all, its a public load balancer" - from_port = 443 - to_port = 443 - protocol = "tcp" - cidr_blocks = var.alb_config.allowed_cidrs - ipv6_cidr_blocks = var.alb_config.allowed_ipv6_cidrs - } - - ingress { - description = "For http to https redirect" - from_port = 80 - to_port = 80 - protocol = "tcp" - cidr_blocks = var.alb_config.allowed_cidrs - ipv6_cidr_blocks = var.alb_config.allowed_ipv6_cidrs - } - - egress { - description = "Egress to all" - from_port = 0 - to_port = 0 - protocol = "-1" - cidr_blocks = var.alb_config.egress_cidrs - ipv6_cidr_blocks = var.alb_config.egress_ipv6_cidrs - } -} - -resource "aws_secretsmanager_secret" "mdmproxy" { - name = "${var.customer_prefix}-mdmproxy" -} - -resource "aws_secretsmanager_secret_version" "mdmproxy" { - secret_id = aws_secretsmanager_secret.mdmproxy.id - secret_string = jsonencode(local.mdmproxy_secrets) -} - -resource "aws_ecs_service" "mdmproxy" { - name = "${var.customer_prefix}-mdmproxy" - launch_type = "FARGATE" - cluster = var.ecs_cluster - task_definition = aws_ecs_task_definition.mdmproxy.arn - desired_count = var.config.desired_count - deployment_minimum_healthy_percent = 100 - deployment_maximum_percent = 200 - force_new_deployment = true - - triggers = { - redeployment = md5(jsonencode(aws_secretsmanager_secret_version.mdmproxy.secret_string)) - } - - load_balancer { - target_group_arn = module.alb.target_group_arns[0] - container_name = "mdmproxy" - container_port = 8080 - } - - lifecycle { - ignore_changes = [desired_count] - } - - network_configuration { - subnets = var.config.networking.subnets - security_groups = var.config.networking.security_groups == null ? aws_security_group.mdmproxy.*.id : var.config.networking.security_groups - } -} - -resource "aws_ecs_task_definition" "mdmproxy" { - family = "${var.customer_prefix}-mdmproxy" - cpu = var.config.cpu - memory = var.config.mem - execution_role_arn = aws_iam_role.execution.arn - network_mode = "awsvpc" - requires_compatibilities = ["FARGATE"] - - container_definitions = jsonencode([ - { - name = "mdmproxy" - image = var.config.image - cpu = var.config.cpu - memory = var.config.mem - essential = true - portMappings = [ - { - # This port is the same that the contained application also uses - containerPort = 8080 - protocol = "tcp" - } - ] - networkMode = "awsvpc" - secrets = [ - { - name = "MDMPROXY_AUTH_TOKEN" - valueFrom = "${aws_secretsmanager_secret.mdmproxy.arn}:MDMPROXY_AUTH_TOKEN::" - }, - { - name = "MDMPROXY_MIGRATE_UDIDS" - valueFrom = "${aws_secretsmanager_secret.mdmproxy.arn}:MDMPROXY_MIGRATE_UDIDS::" - }, - ] - repositoryCredentials = var.config.repository_credentials - ulimits = [ - { - name = "nofile" - softLimit = 999999 - hardLimit = 999999 - } - ] - environment = [ - { - name = "MDMPROXY_SERVER_ADDRESS" - value = ":8080" - }, - { - name = "MDMPROXY_MIGRATE_PERCENTAGE" - value = tostring(var.config.migrate_percentage) - }, - { - name = "MDMPROXY_EXISTING_HOSTNAME" - value = var.config.existing_hostname - }, - { - name = "MDMPROXY_EXISTING_URL" - value = var.config.existing_url - }, - { - name = "MDMPROXY_FLEET_URL" - value = var.config.fleet_url - }, - ] - logConfiguration = { - logDriver = "awslogs" - options = { - awslogs-group = var.awslogs_config.group - awslogs-region = var.awslogs_config.region == null ? data.aws_region.current.name : var.awslogs_config.region - awslogs-stream-prefix = "${var.awslogs_config.prefix}-mdmproxy" - } - } - } - ]) -} - - - diff --git a/terraform/addons/mdmproxy/outputs.tf b/terraform/addons/mdmproxy/outputs.tf deleted file mode 100644 index e018b7b920a9..000000000000 --- a/terraform/addons/mdmproxy/outputs.tf +++ /dev/null @@ -1,7 +0,0 @@ -output "alb" { - value = module.alb -} - -output "ecs_service_name" { - value = aws_ecs_service.mdmproxy.name -} diff --git a/terraform/addons/mdmproxy/variables.tf b/terraform/addons/mdmproxy/variables.tf deleted file mode 100644 index cd743e0276ab..000000000000 --- a/terraform/addons/mdmproxy/variables.tf +++ /dev/null @@ -1,85 +0,0 @@ -variable "awslogs_config" { - type = object({ - group = string - region = string - prefix = optional(string, "mdmproxy") - }) -} - -variable "ecs_cluster" { - type = string -} - -variable "vpc_id" { - type = string - nullable = false -} - -variable "customer_prefix" { - type = string - default = "fleet" -} - -variable "config" { - type = object({ - extra_execution_iam_policies = optional(list(string), []) - mem = optional(number, 2048) - cpu = optional(number, 1024) - image = string - desired_count = optional(number, 1) - repository_credentials = optional(string, null) - migrate_percentage = number - existing_hostname = string - existing_url = string - fleet_url = string - migrate_udids = optional(list(string), []) - auth_token = optional(string, "") - iam = optional(object({ - execution = optional(object({ - name = optional(string, "mdmproxy-execution-role") - policy_name = optional(string, "mdmproxy-iam-policy-execution") - }), { - name = "mdmproxy-execution-role" - policy_name = "mdmproxy-iam-policy-execution" - }) - }), { - name = "mdmproxy-execution-role" - policy_name = "mdmproxy-iam-policy-execution" - }) - networking = object({ - subnets = list(string) - security_groups = optional(list(string), null) - security_group_name = optional(string, "fleet-mdmproxy") - ingress_sources = optional(object({ - cidr_blocks = optional(list(string), []) - ipv6_cidr_blocks = optional(list(string), []) - security_groups = optional(list(string), []) - prefix_list_ids = optional(list(string), []) - }), { - cidr_blocks = [] - ipv6_cidr_blocks = [] - security_groups = [] - prefix_list_ids = [] - }) - }) - }) -} - -variable "alb_config" { - type = object({ - name = optional(string, "fleet-mdmproxy") - subnets = list(string) - security_groups = optional(list(string), []) - access_logs = optional(map(string), {}) - certificate_arn = string - allowed_cidrs = optional(list(string), ["0.0.0.0/0"]) - allowed_ipv6_cidrs = optional(list(string), ["::/0"]) - egress_cidrs = optional(list(string), ["0.0.0.0/0"]) - egress_ipv6_cidrs = optional(list(string), ["::/0"]) - extra_target_groups = optional(any, []) - https_listener_rules = optional(any, []) - tls_policy = optional(string, "ELBSecurityPolicy-TLS-1-2-2017-01") - idle_timeout = optional(number, 905) - }) -} - diff --git a/terraform/addons/migrations/.header.md b/terraform/addons/migrations/.header.md deleted file mode 100644 index fb6c7c9ebd9c..000000000000 --- a/terraform/addons/migrations/.header.md +++ /dev/null @@ -1,6 +0,0 @@ -# Migrations addon -This addon enables automatic migrations for Fleet. -Due to limitations in the AWS provider for Terraform, only Linux platforms are supported. -This module uses the local-exec provisioner to call aws-cli to complete migrations. -Due to this, the following commands must be available to the shell: -- aws diff --git a/terraform/addons/migrations/.terraform-docs.yml b/terraform/addons/migrations/.terraform-docs.yml deleted file mode 100644 index 1d139ddb401d..000000000000 --- a/terraform/addons/migrations/.terraform-docs.yml +++ /dev/null @@ -1 +0,0 @@ -header-from: .header.md diff --git a/terraform/addons/migrations/README.md b/terraform/addons/migrations/README.md deleted file mode 100644 index 7a83426c5a26..000000000000 --- a/terraform/addons/migrations/README.md +++ /dev/null @@ -1,45 +0,0 @@ -# Migrations addon -This addon enables automatic migrations for Fleet. -Due to limitations in the AWS provider for Terraform, only Linux platforms are supported. -This module uses the local-exec provisioner to call aws-cli to complete migrations. -Due to this, the following commands must be available to the shell: -- aws - -## Requirements - -No requirements. - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | 5.31.0 | -| [null](#provider\_null) | 3.2.2 | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [null_resource.main](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | -| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [desired\_count](#input\_desired\_count) | n/a | `number` | n/a | yes | -| [ecs\_cluster](#input\_ecs\_cluster) | n/a | `string` | n/a | yes | -| [ecs\_service](#input\_ecs\_service) | n/a | `string` | n/a | yes | -| [min\_capacity](#input\_min\_capacity) | n/a | `number` | n/a | yes | -| [security\_groups](#input\_security\_groups) | n/a | `list(string)` | n/a | yes | -| [subnets](#input\_subnets) | n/a | `list(string)` | n/a | yes | -| [task\_definition](#input\_task\_definition) | n/a | `string` | n/a | yes | -| [task\_definition\_revision](#input\_task\_definition\_revision) | n/a | `number` | n/a | yes | - -## Outputs - -No outputs. diff --git a/terraform/addons/migrations/main.tf b/terraform/addons/migrations/main.tf deleted file mode 100644 index 4d2ae5915d29..000000000000 --- a/terraform/addons/migrations/main.tf +++ /dev/null @@ -1,10 +0,0 @@ -data "aws_region" "current" {} - -resource "null_resource" "main" { - triggers = { - task_definition_revision = var.task_definition_revision - } - provisioner "local-exec" { - command = "/bin/bash ${path.module}/migrate.sh REGION=${data.aws_region.current.name} VULN_SERVICE=${var.vuln_service} ECS_CLUSTER=${var.ecs_cluster} TASK_DEFINITION=${var.task_definition} TASK_DEFINITION_REVISION=${var.task_definition_revision} SUBNETS=${jsonencode(var.subnets)} SECURITY_GROUPS=${jsonencode(var.security_groups)} ECS_SERVICE=${var.ecs_service} MIN_CAPACITY=${var.min_capacity} DESIRED_COUNT=${var.desired_count}" - } -} diff --git a/terraform/addons/migrations/migrate.sh b/terraform/addons/migrations/migrate.sh deleted file mode 100644 index 7d09fe71abef..000000000000 --- a/terraform/addons/migrations/migrate.sh +++ /dev/null @@ -1,62 +0,0 @@ -#!/bin/bash -set -e - -function scale_services(){ - UP_DOWN="${1:?}" - SERVICE_NAME="${2:?}" # Take service name as an argument - ADJUST_AUTOSCALING="${3:-}" - COUNT="${4:-1}" - - # Set the minimum capacity and desired count in the cluster to 0 to scale down or to the original size to scale back to normal. - - # This is a bit hacky, but the update-service has to happen first when scaling up and second when scaling down. - # Assume scaling down unless "up". - CAPACITY=0 - if [ "${UP_DOWN:?}" = "up" ]; then - aws ecs update-service --region "${REGION:?}" --cluster "${ECS_CLUSTER:?}" --service "${SERVICE_NAME:?}" --desired-count "${COUNT:?}" - CAPACITY="${MIN_CAPACITY:?}" - fi - - if [ -n "${ADJUST_AUTOSCALING}" ]; then - aws application-autoscaling register-scalable-target --region "${REGION:?}" --service-namespace ecs --resource-id "service/${ECS_CLUSTER:?}/${SERVICE_NAME:?}" --scalable-dimension "ecs:service:DesiredCount" --min-capacity "${CAPACITY:?}" - fi - # We are scaling down, make it 0 - if [ "${UP_DOWN:?}" != "up" ]; then - aws ecs update-service --region "${REGION:?}" --cluster "${ECS_CLUSTER:?}" --service "${SERVICE_NAME:?}" --desired-count 0 - fi - # The first task definition might never get stable because it never had initial migrations so don't wait before continuing - if [ "${TASK_DEFINITION_REVISION}" != "1" ]; then - # Wait for scale-down to succeed - aws ecs wait services-stable --region "${REGION:?}" --cluster "${ECS_CLUSTER:?}" --services "${SERVICE_NAME:?}" - fi -} - -for ARGUMENT in "$@" -do - KEY=$(echo $ARGUMENT | cut -f1 -d=) - KEY_LENGTH=${#KEY} - VALUE="${ARGUMENT:$KEY_LENGTH+1}" - export "$KEY"="$VALUE" -done - -scale_services down "${ECS_SERVICE:?}" true "${DESIRED_COUNT}" - -if [ -n "${VULN_SERVICE}" ]; then - scale_services down "${VULN_SERVICE:?}" -fi - -# Call aws ecs run-task -TASK_ARN="$(aws ecs run-task --region "${REGION:?}" --cluster "${ECS_CLUSTER:?}" --task-definition "${TASK_DEFINITION:?}":"${TASK_DEFINITION_REVISION:?}" --launch-type FARGATE --network-configuration "awsvpcConfiguration={subnets="${SUBNETS:?}",securityGroups="${SECURITY_GROUPS:?}"}" --query 'tasks[].taskArn' --overrides '{"containerOverrides": [{"name": "fleet", "command": ["fleet", "prepare", "db"]}]}' --output text | rev | cut -d'/' -f1 | rev)" - -# Wait for completion -aws ecs wait tasks-stopped --region "${REGION:?}" --cluster="${ECS_CLUSTER:?}" --tasks="${TASK_ARN:?}" - -scale_services up "${ECS_SERVICE:?}" true "${DESIRED_COUNT}" - -if [ -n "${VULN_SERVICE}" ]; then - scale_services up "${VULN_SERVICE:?}" -fi - -# Exit with task's exit code -TASK_EXIT_CODE=$(aws ecs describe-tasks --region "${REGION:?}" --cluster "${ECS_CLUSTER:?}" --tasks "${TASK_ARN:?}" --query "tasks[0].containers[?name=='fleet'].exitCode" --output text) -exit "${TASK_EXIT_CODE}" diff --git a/terraform/addons/migrations/outputs.tf b/terraform/addons/migrations/outputs.tf deleted file mode 100644 index e69de29bb2d1..000000000000 diff --git a/terraform/addons/migrations/variables.tf b/terraform/addons/migrations/variables.tf deleted file mode 100644 index 6a4002b4a94e..000000000000 --- a/terraform/addons/migrations/variables.tf +++ /dev/null @@ -1,44 +0,0 @@ -variable "ecs_cluster" { - type = string - nullable = false -} - -variable "ecs_service" { - type = string - nullable = false -} - -variable "min_capacity" { - type = number - nullable = false -} - -variable "desired_count" { - type = number - nullable = false -} - -variable "task_definition" { - type = string - nullable = false -} - -variable "task_definition_revision" { - type = number - nullable = false -} - -variable "subnets" { - type = list(string) - nullable = false -} - -variable "security_groups" { - type = list(string) - nullable = false -} - -variable "vuln_service" { - default = "" -} - diff --git a/terraform/addons/monitoring/.header.md b/terraform/addons/monitoring/.header.md deleted file mode 100644 index 2ee8d34c175f..000000000000 --- a/terraform/addons/monitoring/.header.md +++ /dev/null @@ -1,99 +0,0 @@ -# Monitoring addon -This addon enables Cloudwatch monitoring for Fleet. - -This includes: - -- 5XX Errors on ALB -- ECS Service Monitoring -- RDS Monitoring -- Redis Monitoring -- ACM Certificate Monitoring -- A custom Lambda to check the Fleet DB for Cron runs - -# Preparation - -Some of the for_each and counts in this module cannot pre-determine the numbers until the `main` fleet module is applied. - -You will need to `terraform apply -target module.main` prior applying monitoring assuming the use of a configuration matching the example at https://github.com/fleetdm/fleet/blob/main/terraform/example/main.tf. - -Multiple alb support was added in order to allow monitoring `saml-auth-proxy`. See https://github.com/fleetdm/fleet/tree/main/terraform/addons/saml-auth-proxy - -# Example configuration - -This assumes your fleet module is `main` and is configured with it's default documentation. - - https://github.com/fleetdm/fleet/blob/main/terraform/example/main.tf for details. - - -Note if you haven't specified defined `local.customer` or customized service names, the default is "fleet" for anywhere that `local.customer` is specified below. - -``` -module "monitoring" { - source = "github.com/fleetdm/fleet//terraform/addons/monitoring?ref=tf-mod-addon-monitoring-v1.4.0" - customer_prefix = local.customer - fleet_ecs_service_name = module.main.byo-vpc.byo-db.byo-ecs.service.name - albs = [ - { - name = module.main.byo-vpc.byo-db.alb.lb_dns_name, - target_group_name = module.main.byo-vpc.byo-db.alb.target_group_names[0] - target_group_arn_suffix = module.main.byo-vpc.byo-db.alb.target_group_arn_suffixes[0] - arn_suffix = module.main.byo-vpc.byo-db.alb.lb_arn_suffix - ecs_service_name = module.main.byo-vpc.byo-db.byo-ecs.service.name - min_containers = module.main.byo-vpc.byo-db.byo-ecs.appautoscaling_target.min_capacity - alert_thresholds = { - HTTPCode_ELB_5XX_Count = { - period = 3600 - threshold = 2 - }, - HTTPCode_Target_5XX_Count = { - period = 120 - threshold = 0 - } - } - }, - ] - sns_topic_arns_map = { - alb_httpcode_5xx = [var.sns_topic_arn] - cron_monitoring = [var.sns_topic_arn] - cron_job_failure_monitoring = [var.sns_another_topic_arn] - } - mysql_cluster_members = module.main.byo-vpc.rds.cluster_members - # The cloudposse module seems to have a nested list here. - redis_cluster_members = module.main.byo-vpc.redis.member_clusters[0] - acm_certificate_arn = module.acm.acm_certificate_arn - cron_monitoring = { - mysql_host = module.main.byo-vpc.rds.cluster_reader_endpoint - mysql_database = module.main.byo-vpc.rds.cluster_database_name - mysql_user = module.main.byo-vpc.rds.cluster_master_username - mysql_password_secret_name = module.main.byo-vpc.secrets.secret_ids["${local.customer}-database-password"] - rds_security_group_id = module.main.byo-vpc.rds.security_group_id - subnet_ids = module.main.vpc.private_subnets - vpc_id = module.main.vpc.vpc_id - # Format of https://pkg.go.dev/time#ParseDuration - delay_tolerance = "4h" - # Interval format for: https://docs.aws.amazon.com/scheduler/latest/UserGuide/schedule-types.html#rate-based - run_interval = "1 hour" - log_retention_in_days = 365 - } -} -``` - -# SNS topic ARNs map - -Valid targets for `sns_topic_arns_map`: - - - acm_certificate_expired - - alb_helthyhosts - - alb_httpcode_5xx - - backend_response_time - - cron_monitoring (notifications about failures in the cron scheduler) - - cron_job_failure_monitoring (notifications about errors in individual cron jobs - defaults to value of `cron_monitoring`) - - rds_cpu_untilizaton_too_high - - rds_db_event_subscription - - redis_cpu_engine_utilization - - redis_cpu_utilization - - redis_current_connections - - redis_database_memory_percentage - - redis_replication_lag - -If you want to publish to all, use `default_sns_topic_arns` instead and include your notification ARNs there. diff --git a/terraform/addons/monitoring/.terraform-docs.yml b/terraform/addons/monitoring/.terraform-docs.yml deleted file mode 100644 index 1d139ddb401d..000000000000 --- a/terraform/addons/monitoring/.terraform-docs.yml +++ /dev/null @@ -1 +0,0 @@ -header-from: .header.md diff --git a/terraform/addons/monitoring/README.md b/terraform/addons/monitoring/README.md deleted file mode 100644 index 756f6ca2678a..000000000000 --- a/terraform/addons/monitoring/README.md +++ /dev/null @@ -1,166 +0,0 @@ -# Monitoring addon -This addon enables Cloudwatch monitoring for Fleet. - -This includes: - -- 5XX Errors on ALB -- ECS Service Monitoring -- RDS Monitoring -- Redis Monitoring -- ACM Certificate Monitoring -- A custom Lambda to check the Fleet DB for Cron runs - -# Preparation - -Some of the for\_each and counts in this module cannot pre-determine the numbers until the `main` fleet module is applied. - -You will need to `terraform apply -target module.main` prior applying monitoring assuming the use of a configuration matching the example at https://github.com/fleetdm/fleet/blob/main/terraform/example/main.tf. - -Multiple alb support was added in order to allow monitoring `saml-auth-proxy`. See https://github.com/fleetdm/fleet/tree/main/terraform/addons/saml-auth-proxy - -# Example configuration - -This assumes your fleet module is `main` and is configured with it's default documentation. - - https://github.com/fleetdm/fleet/blob/main/terraform/example/main.tf for details. - -Note if you haven't specified defined `local.customer` or customized service names, the default is "fleet" for anywhere that `local.customer` is specified below. - -``` -module "monitoring" { - source = "github.com/fleetdm/fleet//terraform/addons/monitoring?ref=tf-mod-addon-monitoring-v1.4.0" - customer_prefix = local.customer - fleet_ecs_service_name = module.main.byo-vpc.byo-db.byo-ecs.service.name - albs = [ - { - name = module.main.byo-vpc.byo-db.alb.lb_dns_name, - target_group_name = module.main.byo-vpc.byo-db.alb.target_group_names[0] - target_group_arn_suffix = module.main.byo-vpc.byo-db.alb.target_group_arn_suffixes[0] - arn_suffix = module.main.byo-vpc.byo-db.alb.lb_arn_suffix - ecs_service_name = module.main.byo-vpc.byo-db.byo-ecs.service.name - min_containers = module.main.byo-vpc.byo-db.byo-ecs.appautoscaling_target.min_capacity - alert_thresholds = { - HTTPCode_ELB_5XX_Count = { - period = 3600 - threshold = 2 - }, - HTTPCode_Target_5XX_Count = { - period = 120 - threshold = 0 - } - } - }, - ] - sns_topic_arns_map = { - alb_httpcode_5xx = [var.sns_topic_arn] - cron_monitoring = [var.sns_topic_arn] - cron_job_failure_monitoring = [var.sns_another_topic_arn] - } - mysql_cluster_members = module.main.byo-vpc.rds.cluster_members - # The cloudposse module seems to have a nested list here. - redis_cluster_members = module.main.byo-vpc.redis.member_clusters[0] - acm_certificate_arn = module.acm.acm_certificate_arn - cron_monitoring = { - mysql_host = module.main.byo-vpc.rds.cluster_reader_endpoint - mysql_database = module.main.byo-vpc.rds.cluster_database_name - mysql_user = module.main.byo-vpc.rds.cluster_master_username - mysql_password_secret_name = module.main.byo-vpc.secrets.secret_ids["${local.customer}-database-password"] - rds_security_group_id = module.main.byo-vpc.rds.security_group_id - subnet_ids = module.main.vpc.private_subnets - vpc_id = module.main.vpc.vpc_id - # Format of https://pkg.go.dev/time#ParseDuration - delay_tolerance = "4h" - # Interval format for: https://docs.aws.amazon.com/scheduler/latest/UserGuide/schedule-types.html#rate-based - run_interval = "1 hour" - log_retention_in_days = 365 - } -} -``` - -# SNS topic ARNs map - -Valid targets for `sns_topic_arns_map`: - - - acm\_certificate\_expired - - alb\_helthyhosts - - alb\_httpcode\_5xx - - backend\_response\_time - - cron\_monitoring (notifications about failures in the cron scheduler) - - cron\_job\_failure\_monitoring (notifications about errors in individual cron jobs - defaults to value of `cron_monitoring`) - - rds\_cpu\_untilizaton\_too\_high - - rds\_db\_event\_subscription - - redis\_cpu\_engine\_utilization - - redis\_cpu\_utilization - - redis\_current\_connections - - redis\_database\_memory\_percentage - - redis\_replication\_lag - -If you want to publish to all, use `default_sns_topic_arns` instead and include your notification ARNs there. - -## Requirements - -No requirements. - -## Providers - -| Name | Version | -|------|---------| -| [archive](#provider\_archive) | 2.7.0 | -| [aws](#provider\_aws) | 5.81.0 | -| [null](#provider\_null) | 3.2.3 | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [aws_cloudwatch_event_rule.cron_monitoring_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource | -| [aws_cloudwatch_event_target.cron_monitoring_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource | -| [aws_cloudwatch_log_group.cron_monitoring_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource | -| [aws_cloudwatch_metric_alarm.acm_certificate_expired](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_metric_alarm) | resource | -| [aws_cloudwatch_metric_alarm.alb_healthyhosts](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_metric_alarm) | resource | -| [aws_cloudwatch_metric_alarm.cpu_utilization_too_high](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_metric_alarm) | resource | -| [aws_cloudwatch_metric_alarm.lb](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_metric_alarm) | resource | -| [aws_cloudwatch_metric_alarm.redis-current-connections](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_metric_alarm) | resource | -| [aws_cloudwatch_metric_alarm.redis-database-memory-percentage](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_metric_alarm) | resource | -| [aws_cloudwatch_metric_alarm.redis-replication-lag](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_metric_alarm) | resource | -| [aws_cloudwatch_metric_alarm.redis_cpu](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_metric_alarm) | resource | -| [aws_cloudwatch_metric_alarm.redis_cpu_engine_utilization](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_metric_alarm) | resource | -| [aws_cloudwatch_metric_alarm.target_response_time](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_metric_alarm) | resource | -| [aws_db_event_subscription.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_event_subscription) | resource | -| [aws_iam_policy.cron_monitoring_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | -| [aws_iam_role.cron_monitoring_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | -| [aws_iam_role_policy_attachment.cron_monitoring_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | -| [aws_iam_role_policy_attachment.cron_monitoring_lambda_managed](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | -| [aws_lambda_function.cron_monitoring](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function) | resource | -| [aws_lambda_permission.cron_monitoring_cloudwatch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource | -| [aws_security_group.cron_monitoring](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource | -| [aws_security_group_rule.cron_monitoring_to_rds](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group_rule) | resource | -| [null_resource.cron_monitoring_build](https://registry.terraform.io/providers/hashicorp/null/latest/docs/resources/resource) | resource | -| [archive_file.cron_monitoring_lambda](https://registry.terraform.io/providers/hashicorp/archive/latest/docs/data-sources/file) | data source | -| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | -| [aws_iam_policy_document.cron_monitoring_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.cron_monitoring_lambda_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | -| [aws_secretsmanager_secret.mysql_database_password](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/secretsmanager_secret) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [acm\_certificate\_arn](#input\_acm\_certificate\_arn) | n/a | `string` | `null` | no | -| [albs](#input\_albs) | n/a | 
list(object({
    name                    = string
    arn_suffix              = string
    target_group_name       = string
    target_group_arn_suffix = string
    min_containers          = optional(string, 1)
    ecs_service_name        = string
    alert_thresholds = optional(
      object({
        HTTPCode_ELB_5XX_Count = object({
          period    = number
          threshold = number
        })
        HTTPCode_Target_5XX_Count = object({
          period    = number
          threshold = number
        })
      }),
      {
        HTTPCode_ELB_5XX_Count = {
          period    = 120
          threshold = 0
        },
        HTTPCode_Target_5XX_Count = {
          period    = 120
          threshold = 0
        }
      }
    )
  }))
| `[]` | no | -| [cron\_monitoring](#input\_cron\_monitoring) | n/a | 
object({
    mysql_host                 = string
    mysql_database             = string
    mysql_user                 = string
    mysql_password_secret_name = string
    vpc_id                     = string
    subnet_ids                 = list(string)
    rds_security_group_id      = string
    delay_tolerance            = string
    run_interval               = string
    log_retention_in_days      = optional(number, 7)
  })
| `null` | no | -| [customer\_prefix](#input\_customer\_prefix) | n/a | `string` | `"fleet"` | no | -| [default\_sns\_topic\_arns](#input\_default\_sns\_topic\_arns) | n/a | `list(string)` | `[]` | no | -| [fleet\_ecs\_service\_name](#input\_fleet\_ecs\_service\_name) | n/a | `string` | `null` | no | -| [mysql\_cluster\_members](#input\_mysql\_cluster\_members) | n/a | `list(string)` | `[]` | no | -| [redis\_cluster\_members](#input\_redis\_cluster\_members) | n/a | `list(string)` | `[]` | no | -| [sns\_topic\_arns\_map](#input\_sns\_topic\_arns\_map) | n/a | `map(list(string))` | `{}` | no | - -## Outputs - -No outputs. diff --git a/terraform/addons/monitoring/lambda/.gitignore b/terraform/addons/monitoring/lambda/.gitignore deleted file mode 100644 index 8c7f193def3a..000000000000 --- a/terraform/addons/monitoring/lambda/.gitignore +++ /dev/null @@ -1,3 +0,0 @@ -exports.sh -.lambda.zip -bootstrap diff --git a/terraform/addons/monitoring/lambda/go.mod b/terraform/addons/monitoring/lambda/go.mod deleted file mode 100644 index 9304d2e4ab67..000000000000 --- a/terraform/addons/monitoring/lambda/go.mod +++ /dev/null @@ -1,16 +0,0 @@ -module github.com/fleetdm/fleet/terraform/addons/monitoring/lambda - -go 1.23.4 - -require ( - github.com/aws/aws-lambda-go v1.41.0 - github.com/aws/aws-sdk-go v1.45.25 - github.com/aws/aws-secretsmanager-caching-go v1.1.2 - github.com/go-sql-driver/mysql v1.7.1 - github.com/jessevdk/go-flags v1.5.0 -) - -require ( - github.com/jmespath/go-jmespath v0.4.0 // indirect - golang.org/x/sys v0.9.0 // indirect -) diff --git a/terraform/addons/monitoring/lambda/go.sum b/terraform/addons/monitoring/lambda/go.sum deleted file mode 100644 index f7168260028f..000000000000 --- a/terraform/addons/monitoring/lambda/go.sum +++ /dev/null @@ -1,74 +0,0 @@ -github.com/aws/aws-lambda-go v1.41.0 h1:l/5fyVb6Ud9uYd411xdHZzSf2n86TakxzpvIoz7l+3Y= -github.com/aws/aws-lambda-go v1.41.0/go.mod h1:jwFe2KmMsHmffA1X2R09hH6lFzJQxzI8qK17ewzbQMM= -github.com/aws/aws-sdk-go v1.44.287/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI= -github.com/aws/aws-sdk-go v1.45.25 h1:c4fLlh5sLdK2DCRTY1z0hyuJZU4ygxX8m1FswL6/nF4= -github.com/aws/aws-sdk-go v1.45.25/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI= -github.com/aws/aws-secretsmanager-caching-go v1.1.2 h1:tY3pRhAkaohm75KFpGHoqjWrnRpznqrc8iX/wTLVpH0= -github.com/aws/aws-secretsmanager-caching-go v1.1.2/go.mod h1:s3Or+O0O8obPyDJz6875Rg1WApAbQ64L0WTBwYNnKLo= -github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= -github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= -github.com/go-sql-driver/mysql v1.7.1 h1:lUIinVbN1DY0xBg0eMOzmmtGoHwWBbvnWubQUrtU8EI= -github.com/go-sql-driver/mysql v1.7.1/go.mod h1:OXbVy3sEdcQ2Doequ6Z5BW6fXNQTmx+9S1MCJN5yJMI= -github.com/jessevdk/go-flags v1.5.0 h1:1jKYvbxEjfUl0fmqTCOfonvskHHXMjBySTLW4y9LFvc= -github.com/jessevdk/go-flags v1.5.0/go.mod h1:Fw0T6WPc1dYxT4mKEZRfG5kJhaTDP9pj1c2EWnYs/m4= -github.com/jmespath/go-jmespath v0.4.0 h1:BEgLn5cpjn8UN1mAw4NjwDrS35OdebyEtFe+9YPoQUg= -github.com/jmespath/go-jmespath v0.4.0/go.mod h1:T8mJZnbsbmF+m6zOOFylbeCJqk5+pHWvzYPziyZiYoo= -github.com/jmespath/go-jmespath/internal/testify v1.5.1 h1:shLQSRRSCCPj3f2gpwzGwWFoC7ycTf1rcQZHOlsJ6N8= -github.com/jmespath/go-jmespath/internal/testify v1.5.1/go.mod h1:L3OGu8Wl2/fWfCI6z80xFu9LTZmf1ZRjMHUOPmWr69U= -github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0= -github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= -github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= -github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME= -github.com/stretchr/testify v1.7.2 h1:4jaiDzPyXQvSd7D0EjG45355tLlV3VOECpq10pLC+8s= -github.com/stretchr/testify v1.7.2/go.mod h1:R6va5+xMeoiuVRoj+gSkQ7d3FALtqAAGI1FQKckRals= -github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= -golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= -golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.10.0/go.mod h1:o4eNf7Ede1fv+hwOwZsTHl9EsPFO6q6ZvYR8vYfY45I= -golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= -golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs= -golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= -golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= -golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= -golang.org/x/net v0.1.0/go.mod h1:Cx3nUiGt4eDBEyega/BKRp+/AlGL8hYe7U9odMt2Cco= -golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= -golang.org/x/net v0.10.0/go.mod h1:0qNGK6F8kojg2nk9dLZ2mShWaEBan6FAoqfSigmmuDg= -golang.org/x/net v0.11.0/go.mod h1:2L/ixqYpgIVXmeoSA/4Lu7BzTG4KIyPIryS4IsOd1oQ= -golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.1.0/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= -golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210320140829-1e4c9ba3b0c4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= -golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.9.0 h1:KS/R3tvhPqvJvwcKfnBHJwwthS11LRhmM5D59eEXa0s= -golang.org/x/sys v0.9.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= -golang.org/x/term v0.1.0/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= -golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= -golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo= -golang.org/x/term v0.9.0/go.mod h1:M6DEAAIenWoTxdKrOltXcmDY3rSplQUkrvaDU5FcQyo= -golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= -golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= -golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= -golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= -golang.org/x/text v0.9.0/go.mod h1:e1OnstbJyHTd6l/uOt8jFFHp6TRDWZR/bV3emEE/zU8= -golang.org/x/text v0.10.0/go.mod h1:TvPlkZtksWOMsz7fbANvkp4WM8x/WCo/om8BMLbz+aE= -golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= -golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= -golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= -golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU= -golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= -gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= -gopkg.in/yaml.v2 v2.2.8 h1:obN1ZagJSUGI0Ek/LBmuj4SNLPfIny3KsKFopxRdj10= -gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= -gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= -gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= diff --git a/terraform/addons/monitoring/lambda/main.go b/terraform/addons/monitoring/lambda/main.go deleted file mode 100644 index 2e44c1a198db..000000000000 --- a/terraform/addons/monitoring/lambda/main.go +++ /dev/null @@ -1,282 +0,0 @@ -/* -This script is intended to be used with AWS Lambda to monitor the various -crons that live inside of Fleet. - -We will check to see if there are recent updates from the crons in the -following table: - - - cron_stats - -If we have an old/incomplete run in cron_stats or if we are missing a -cron entry entirely, throw an alert to an SNS topic. - -Currently tested crons: - - - cleanups_then_aggregation - - vulnerabilities - -*/ - -package main - -import ( - "context" - "database/sql" - "fmt" - "log" - "strconv" - "strings" - "time" - - "github.com/aws/aws-lambda-go/lambda" - "github.com/aws/aws-sdk-go/aws" - "github.com/aws/aws-sdk-go/aws/session" - "github.com/aws/aws-sdk-go/service/secretsmanager" - "github.com/aws/aws-sdk-go/service/sns" - "github.com/aws/aws-secretsmanager-caching-go/secretcache" - "github.com/go-sql-driver/mysql" - flags "github.com/jessevdk/go-flags" -) - -type ( - NullEvent struct{} - SNSTopicArnsMap map[string]string -) - -type OptionsStruct struct { - LambdaRuntimeAPI string `long:"lambda-runtime-api" env:"AWS_LAMBDA_RUNTIME_API"` - SNSCronSystemTopicArns string `long:"sns-cron-system-topic-arn" env:"CRON_SYSTEM_MONITOR_SNS_TOPIC_ARNS" required:"true"` - SNSCronJobFailureTopicArns string `long:"sns-cron-job-failure-topic-arn" env:"CRON_JOB_FAILURE_MONITOR_SNS_TOPIC_ARNS"` - MySQLHost string `long:"mysql-host" env:"MYSQL_HOST" required:"true"` - MySQLUser string `long:"mysql-user" env:"MYSQL_USER" required:"true"` - MySQLSMSecret string `long:"mysql-secretsmanager-secret" env:"MYSQL_SECRETSMANAGER_SECRET" required:"true"` - MySQLDatabase string `long:"mysql-database" env:"MYSQL_DATABASE" required:"true"` - FleetEnv string `long:"fleet-environment" env:"FLEET_ENV" required:"true"` - AWSRegion string `long:"aws-region" env:"AWS_REGION" required:"true"` - CronDelayTolerance string `long:"cron-delay-tolerance" env:"CRON_DELAY_TOLERANCE" default:"2h"` - CronMonitorInterval string `long:"monitor-run-interval" env:"CRON_MONITOR_RUN_INTERVAL" default:"1 hour"` -} - -var ( - options = OptionsStruct{} - snsTopics = make(SNSTopicArnsMap) -) - -func sendSNSMessage(msg string, topic string, sess *session.Session) { - topicArns, ok := snsTopics[topic] - if !ok { - log.Printf("No SNS topic ARNs available for topic '%s'", topic) - return - } - - log.Printf("Sending SNS Message") - fullMsg := fmt.Sprintf("Environment: %s\nMessage: %s", options.FleetEnv, msg) - svc := sns.New(sess) - for _, SNSTopicArn := range strings.Split(topicArns, ",") { - log.Printf("Sending '%s' to '%s'", fullMsg, SNSTopicArn) - result, err := svc.Publish(&sns.PublishInput{ - Message: &fullMsg, - TopicArn: &SNSTopicArn, - }) - if err != nil { - log.Printf(err.Error()) - } - log.Printf(result.GoString()) - } -} - -func parseLambdaIntervalToDuration(intervalString string) (duration time.Duration, err error) { - var number int - var unit string - - _, err = fmt.Sscanf(intervalString, "%d %s", &number, &unit) - if err != nil { - return 0, err - } - - switch unit { - case "hour", "hours": - unit = "h" - case "minute", "minutes": - unit = "m" - case "day", "days": - unit = "h" - number *= 24 - } - - return time.ParseDuration(strconv.Itoa(number) + unit) -} - -type CronStatsRow struct { - name string - status string - errors string - created_at time.Time - updated_at time.Time -} - -func setupDB(sess *session.Session) (db *sql.DB, err error) { - secretCache, err := secretcache.New() - if err != nil { - log.Printf(err.Error()) - sendSNSMessage("Unable to initialise SecretsManager helper. Cron status is unknown.", "cronSystem", sess) - return db, err - } - - secretCache.Client = secretsmanager.New(sess) - MySQLPassword, err := secretCache.GetSecretString(options.MySQLSMSecret) - if err != nil { - log.Printf(err.Error()) - sendSNSMessage("Unable to retrieve SecretsManager secret. Cron status is unknown.", "cronSystem", sess) - return db, err - } - - cfg := mysql.Config{ - User: options.MySQLUser, - Passwd: MySQLPassword, - Net: "tcp", - Addr: options.MySQLHost, - DBName: options.MySQLDatabase, - AllowNativePasswords: true, - ParseTime: true, - } - - db, err = sql.Open("mysql", cfg.FormatDSN()) - if err != nil { - log.Printf(err.Error()) - sendSNSMessage("Unable to connect to database. Cron status unknown.", "cronSystem", sess) - return db, err - } - if err = db.Ping(); err != nil { - log.Printf(err.Error()) - sendSNSMessage("Unable to connect to database. Cron status unknown.", "cronSystem", sess) - return db, err - } - - log.Printf("Connected to database!") - - return db, err -} - -// Check that the cron stats table is reachable, and that no cron jobs have been stuck for > 1 run time. -func checkDB(db *sql.DB, sess *session.Session) (err error) { - rows, err := db.Query("SELECT b.name,IFNULL(status, 'missing cron'),IFNULL(updated_at, FROM_UNIXTIME(0)) AS updated_at FROM (SELECT 'vulnerabilities' AS name UNION ALL SELECT 'cleanups_then_aggregation') b LEFT JOIN (SELECT name, status, updated_at FROM cron_stats WHERE id IN (SELECT MAX(id) FROM cron_stats WHERE status = 'completed' GROUP BY name)) a ON a.name = b.name;") - defer rows.Close() - if err != nil { - log.Printf(err.Error()) - sendSNSMessage("Unable to SELECT cron_stats table. Unable to continue.", "cronSystem", sess) - return err - } - cronDelayDuration, err := time.ParseDuration(options.CronDelayTolerance) - if err != nil { - log.Printf(err.Error()) - sendSNSMessage("Unable to parse cron-delay-tolerance. Check lambda settings.", "cronSystem", sess) - return err - } - cronAlertTimestamp := time.Now().Add(-1 * cronDelayDuration) - for rows.Next() { - var row CronStatsRow - if err := rows.Scan(&row.name, &row.status, &row.updated_at); err != nil { - log.Printf(err.Error()) - sendSNSMessage("Error scanning row in cron_stats table. Unable to continue.", "cronSystem", sess) - return err - } - log.Printf("Row %s last updated at %s", row.name, row.updated_at.String()) - if row.updated_at.Before(cronAlertTimestamp) { - log.Printf("*** %s hasn't updated in more than %s, alerting! (status %s)", options.CronDelayTolerance, row.name, row.status) - // Fire on the first match and return. We only need to alert that the crons need looked at, not each cron. - sendSNSMessage(fmt.Sprintf("Fleet cron '%s' hasn't updated in more than %s. Last status was '%s' at %s.", row.name, options.CronDelayTolerance, row.status, row.updated_at.String()), "cronSystem", sess) - return nil - } - } - - return nil -} - -// Check for errors in cron runs. -func checkCrons(db *sql.DB, sess *session.Session) (err error) { - cronMonitorInterval, err := parseLambdaIntervalToDuration(options.CronMonitorInterval) - if err != nil { - log.Printf(err.Error()) - sendSNSMessage("Unable to parse cron-delay-tolerance. Check lambda settings.", "cronSystem", sess) - return err - } - cronAlertTimestamp := time.Now().Add(-1 * cronMonitorInterval) - - // Find all cron entries less than cronMonitorInterval old that have errors. - rows, err := db.Query("SELECT name, created_at, IFNULL(updated_at, FROM_UNIXTIME(0)) AS updated_at, errors FROM cron_stats WHERE errors IS NOT NULL AND created_at > \"" + cronAlertTimestamp.Format("20060102150405") + "\"") - defer rows.Close() - if err != nil { - log.Printf(err.Error()) - sendSNSMessage("Unable to SELECT cron_stats table. Unable to continue.", "cronSystem", sess) - return err - } - for rows.Next() { - var row CronStatsRow - if err := rows.Scan(&row.name, &row.created_at, &row.updated_at, &row.errors); err != nil { - log.Printf(err.Error()) - sendSNSMessage("Error scanning row in cron_stats table. Unable to continue.", "cronSystem", sess) - return err - } - log.Printf("*** %s job had errors, alerting! (errors %s)", row.name, row.errors) - // Fire on the first match and return. We only need to alert that the crons need looked at, not each cron. - sendSNSMessage(fmt.Sprintf("Fleet cron '%s' (last updated %s) raised errors during its run:\n%s.", row.name, row.updated_at.String(), row.errors), "cronJobFailure", sess) - } - - return nil -} - -func handler(ctx context.Context, name NullEvent) error { - sess := session.Must(session.NewSessionWithOptions( - session.Options{ - SharedConfigState: session.SharedConfigEnable, - Config: aws.Config{ - Region: &options.AWSRegion, - }, - }, - )) - - db, err := setupDB(sess) - defer db.Close() - - if err != nil { - return nil - } - - checkDB(db, sess) - checkCrons(db, sess) - return nil -} - -func main() { - var err error - log.SetFlags(log.LstdFlags | log.Lshortfile) - // Get config from environment - parser := flags.NewParser(&options, flags.Default) - if _, err = parser.Parse(); err != nil { - if flagsErr, ok := err.(*flags.Error); ok && flagsErr.Type == flags.ErrHelp { - return - } else { - log.Fatal(err) - } - } - - snsTopics["cronSystem"] = options.SNSCronSystemTopicArns - snsTopics["cronJobFailure"] = options.SNSCronJobFailureTopicArns - // For backwards compatibility, fall back to sending cron failure alerts - // to the same SNS topic as cron system alerts.s - if snsTopics["cronJobFailure"] == "" { - snsTopics["cronJobFailure"] = options.SNSCronSystemTopicArns - } - - // When running from Lambda, this should be read from the environment. - if options.LambdaRuntimeAPI != "" { - log.Printf("Starting Lambda handler.") - lambda.Start(handler) - } else { - log.Printf("Lambda execution environment not found. Falling back to local execution.") - if err = handler(context.Background(), NullEvent{}); err != nil { - log.Fatal(err) - } - } -} diff --git a/terraform/addons/monitoring/lambda/osv-scanner.toml b/terraform/addons/monitoring/lambda/osv-scanner.toml deleted file mode 100644 index e1bce5d2de1b..000000000000 --- a/terraform/addons/monitoring/lambda/osv-scanner.toml +++ /dev/null @@ -1,6 +0,0 @@ -# Configure OSV-Scanner -# https://google.github.io/osv-scanner/configuration/ - -[[IgnoredVulns]] -id = "GO-2022-0646" -reason = "2024/04/02 - This project does not use github.com/aws/aws-sdk-go/service/s3/s3crypto. Reference: https://osv.dev/vulnerability/GO-2022-0646" diff --git a/terraform/addons/monitoring/main.tf b/terraform/addons/monitoring/main.tf deleted file mode 100644 index 7bd60c21af5e..000000000000 --- a/terraform/addons/monitoring/main.tf +++ /dev/null @@ -1,487 +0,0 @@ -// Database alarms -resource "aws_cloudwatch_metric_alarm" "cpu_utilization_too_high" { - for_each = toset(var.mysql_cluster_members) - alarm_name = "rds_cpu_utilization_too_high-${var.customer_prefix}-${each.key}" - comparison_operator = "GreaterThanThreshold" - evaluation_periods = "1" - metric_name = "CPUUtilization" - namespace = "AWS/RDS" - period = "300" - statistic = "Average" - threshold = 80 - alarm_description = "Average database CPU utilization over last 5 minutes too high" - alarm_actions = lookup(var.sns_topic_arns_map, "rds_cpu_untilizaton_too_high", var.default_sns_topic_arns) - ok_actions = lookup(var.sns_topic_arns_map, "rds_cpu_untilizaton_too_high", var.default_sns_topic_arns) - dimensions = { - DBInstanceIdentifier = each.key - } -} - -resource "aws_db_event_subscription" "default" { - count = length(var.mysql_cluster_members) == 0 || (contains(keys(var.sns_topic_arns_map), "rds_db_event_subscription") == false && length(var.default_sns_topic_arns) == 0) ? 0 : 1 - name = "rds-event-sub-${var.customer_prefix}" - sns_topic = try(var.sns_topic_arns_map.rds_db_event_subscription[0], var.default_sns_topic_arns[0]) - - source_type = "db-instance" - source_ids = var.mysql_cluster_members - - event_categories = [ - "failover", - "failure", - "low storage", - "maintenance", - "notification", - "recovery", - ] - -} - -locals { - alb_map = { for k, v in var.albs : k => v } -} - - -// ECS Alarms -resource "aws_cloudwatch_metric_alarm" "alb_healthyhosts" { - for_each = local.alb_map - alarm_name = "backend-healthyhosts-${var.customer_prefix}-${each.value.name}" - comparison_operator = "LessThanThreshold" - evaluation_periods = "1" - metric_name = "HealthyHostCount" - namespace = "AWS/ApplicationELB" - period = "60" - statistic = "Minimum" - threshold = each.value.min_containers - alarm_description = "This alarm indicates the number of Healthy Fleet hosts is lower than expected. Please investigate the load balancer \"${each.value.name}\" or the target group \"${each.value.target_group_name}\" and the fleet backend service \"${each.value.ecs_service_name}\"" - actions_enabled = "true" - alarm_actions = lookup(var.sns_topic_arns_map, "alb_helthyhosts", var.default_sns_topic_arns) - ok_actions = lookup(var.sns_topic_arns_map, "alb_helthyhosts", var.default_sns_topic_arns) - dimensions = { - TargetGroup = each.value.target_group_arn_suffix - LoadBalancer = each.value.arn_suffix - } -} - -// alarm for target response time (anomaly detection) -resource "aws_cloudwatch_metric_alarm" "target_response_time" { - for_each = local.alb_map - alarm_name = "backend-target-response-time-${var.customer_prefix}-${each.value.name}" - comparison_operator = "GreaterThanUpperThreshold" - evaluation_periods = "2" - threshold_metric_id = "e1" - alarm_description = "This alarm indicates the Fleet server response time is greater than it usually is. Please investigate the ecs service \"${var.fleet_ecs_service_name}\" because the backend might need to be scaled up." - alarm_actions = lookup(var.sns_topic_arns_map, "backend_response_time", var.default_sns_topic_arns) - ok_actions = lookup(var.sns_topic_arns_map, "backend_response_time", var.default_sns_topic_arns) - insufficient_data_actions = [] - - metric_query { - id = "e1" - expression = "ANOMALY_DETECTION_BAND(m1)" - label = "TargetResponseTime (Expected)" - return_data = "true" - } - - metric_query { - id = "m1" - return_data = "true" - metric { - metric_name = "TargetResponseTime" - namespace = "AWS/ApplicationELB" - period = "120" - stat = "p99" - unit = "Count" - - dimensions = { - TargetGroup = each.value.target_group_arn_suffix - LoadBalancer = each.value.arn_suffix - } - } - } -} - -locals { - http_5xx_alert_names = ["HTTPCode_ELB_5XX_Count", "HTTPCode_Target_5XX_Count"] - http_5xx_alerts_list = flatten([for alert in local.http_5xx_alert_names : [for alb in var.albs : merge(alb, { "alert" : alert })]]) - http_5xx_alerts = { for k, v in local.http_5xx_alerts_list : k => v } -} - - -resource "aws_cloudwatch_metric_alarm" "lb" { - for_each = local.http_5xx_alerts - alarm_name = "${var.customer_prefix}-lb-${each.value.name}-${each.value.alert}" - comparison_operator = "GreaterThanThreshold" - evaluation_periods = "1" - metric_name = each.value.alert - namespace = "AWS/ApplicationELB" - period = each.value.alert_thresholds[each.value.alert].period - statistic = "Sum" - threshold = each.value.alert_thresholds[each.value.alert].threshold - alarm_description = "This alarm indicates there are an abnormal amount of 5XX responses. Either the lb cannot talk with the Fleet backend target or Fleet is returning an error." - alarm_actions = lookup(var.sns_topic_arns_map, "alb_httpcode_5xx", var.default_sns_topic_arns) - ok_actions = lookup(var.sns_topic_arns_map, "alb_httpcode_5xx", var.default_sns_topic_arns) - treat_missing_data = "notBreaching" - dimensions = { - LoadBalancer = each.value.arn_suffix - } -} - - -// Elasticache (redis) alerts https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/CacheMetrics.WhichShouldIMonitor.html -resource "aws_cloudwatch_metric_alarm" "redis_cpu" { - for_each = toset(var.redis_cluster_members) - alarm_name = "redis-cpu-utilization-${each.key}-${var.customer_prefix}" - alarm_description = "Redis cluster CPU utilization node ${each.key}" - comparison_operator = "GreaterThanThreshold" - evaluation_periods = "1" - metric_name = "CPUUtilization" - namespace = "AWS/ElastiCache" - period = "300" - statistic = "Average" - alarm_actions = lookup(var.sns_topic_arns_map, "redis_cpu_utilization", var.default_sns_topic_arns) - ok_actions = lookup(var.sns_topic_arns_map, "redis_cpu_utilization", var.default_sns_topic_arns) - - threshold = "70" - - dimensions = { - CacheClusterId = each.key - } - -} - -resource "aws_cloudwatch_metric_alarm" "redis_cpu_engine_utilization" { - for_each = toset(var.redis_cluster_members) - alarm_name = "redis-cpu-engine-utilization-${each.key}-${var.customer_prefix}" - alarm_description = "Redis cluster CPU Engine utilization node ${each.key}" - comparison_operator = "GreaterThanThreshold" - evaluation_periods = "1" - metric_name = "EngineCPUUtilization" - namespace = "AWS/ElastiCache" - period = "300" - statistic = "Average" - alarm_actions = lookup(var.sns_topic_arns_map, "redis_cpu_engine_utilization", var.default_sns_topic_arns) - ok_actions = lookup(var.sns_topic_arns_map, "redis_cpu_engine_utilization", var.default_sns_topic_arns) - - threshold = "25" - - dimensions = { - CacheClusterId = each.key - } - -} - -resource "aws_cloudwatch_metric_alarm" "redis-database-memory-percentage" { - for_each = toset(var.redis_cluster_members) - alarm_name = "redis-database-memory-percentage-${each.key}-${var.customer_prefix}" - alarm_description = "Percentage of the memory available for the cluster that is in use. This is calculated using used_memory/maxmemory." - comparison_operator = "GreaterThanThreshold" - evaluation_periods = "1" - metric_name = "DatabaseMemoryUsagePercentage" - namespace = "AWS/ElastiCache" - period = "300" - statistic = "Average" - alarm_actions = lookup(var.sns_topic_arns_map, "redis_database_memory_percentage", var.default_sns_topic_arns) - ok_actions = lookup(var.sns_topic_arns_map, "redis_database_memory_percentage", var.default_sns_topic_arns) - - threshold = "80" - - dimensions = { - CacheClusterId = each.key - } - -} - -resource "aws_cloudwatch_metric_alarm" "redis-current-connections" { - for_each = toset(var.redis_cluster_members) - alarm_name = "redis-current-connections-${each.key}-${var.customer_prefix}" - alarm_description = "Redis current connections for node ${each.key}" - comparison_operator = "LessThanLowerOrGreaterThanUpperThreshold" - evaluation_periods = "5" - threshold_metric_id = "e1" - alarm_actions = lookup(var.sns_topic_arns_map, "redis_current_connections", var.default_sns_topic_arns) - ok_actions = lookup(var.sns_topic_arns_map, "redis_current_connections", var.default_sns_topic_arns) - insufficient_data_actions = [] - - metric_query { - id = "e1" - expression = "ANOMALY_DETECTION_BAND(m1,20)" - label = "Current Connections (Expected)" - return_data = "true" - } - - metric_query { - id = "m1" - return_data = "true" - metric { - metric_name = "CurrConnections" - namespace = "AWS/ElastiCache" - period = "600" - stat = "Average" - unit = "Count" - - dimensions = { - CacheClusterId = each.key - } - } - } -} - -resource "aws_cloudwatch_metric_alarm" "redis-replication-lag" { - for_each = toset(var.redis_cluster_members) - alarm_name = "redis-replication-lag-${each.key}-${var.customer_prefix}" - alarm_description = "This metric is only applicable for a node running as a read replica. It represents how far behind, in seconds, the replica is in applying changes from the primary node. For Redis engine version 5.0.6 onwards, the lag can be measured in milliseconds." - comparison_operator = "GreaterThanUpperThreshold" - evaluation_periods = "3" - threshold_metric_id = "e1" - alarm_actions = lookup(var.sns_topic_arns_map, "redis_replication_lag", var.default_sns_topic_arns) - ok_actions = lookup(var.sns_topic_arns_map, "redis_replication_lag", var.default_sns_topic_arns) - insufficient_data_actions = [] - - metric_query { - id = "e1" - expression = "ANOMALY_DETECTION_BAND(m1)" - label = "ReplicationLag (expected)" - return_data = "true" - } - - metric_query { - id = "m1" - return_data = "true" - metric { - metric_name = "ReplicationLag" - namespace = "AWS/ElastiCache" - period = "300" - stat = "p90" - - dimensions = { - CacheClusterId = each.key - } - } - } -} - -// ACM Certificate Manager -resource "aws_cloudwatch_metric_alarm" "acm_certificate_expired" { - count = var.acm_certificate_arn == null ? 0 : 1 - alarm_name = "acm-cert-expiry-${var.customer_prefix}" - comparison_operator = "LessThanThreshold" - evaluation_periods = "1" - period = "86400" // 1 day in seconds - threshold = 30 // days - statistic = "Average" - namespace = "AWS/CertificateManager" - metric_name = "DaysToExpiry" - actions_enabled = "true" - alarm_description = "ACM Certificate will expire soon" - alarm_actions = lookup(var.sns_topic_arns_map, "acm_certificate_expired", var.default_sns_topic_arns) - ok_actions = lookup(var.sns_topic_arns_map, "acm_certificate_expired", var.default_sns_topic_arns) - - dimensions = { - CertificateArn = var.acm_certificate_arn - } -} - -// Cron Monitoring -locals { - cron_lambda_binary = "${path.module}/lambda/bootstrap" -} - -resource "null_resource" "cron_monitoring_build" { - count = var.cron_monitoring == null ? 0 : 1 - triggers = { - main_go_changes = filesha256("${path.module}/lambda/main.go"), - go_mod_changes = filesha256("${path.module}/lambda/go.mod") - go_sum_changes = filesha256("${path.module}/lambda/go.sum") - # Make sure to always have a unique trigger if the file doesn't exist - binary_exists = fileexists(local.cron_lambda_binary) ? true : timestamp() - } - provisioner "local-exec" { - working_dir = "${path.module}/lambda" - command = <<-EOT - go get - CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -tags lambda.norpc -o bootstrap main.go - EOT - } -} - -data "archive_file" "cron_monitoring_lambda" { - count = var.cron_monitoring == null ? 0 : 1 - depends_on = [null_resource.cron_monitoring_build[0]] - type = "zip" - output_path = "${path.module}/lambda/.lambda.zip" - source_file = local.cron_lambda_binary -} - -data "aws_secretsmanager_secret" "mysql_database_password" { - count = var.cron_monitoring == null ? 0 : 1 - name = var.cron_monitoring.mysql_password_secret_name -} - -resource "aws_security_group" "cron_monitoring" { - count = var.cron_monitoring == null ? 0 : 1 - name = "${var.customer_prefix}_cron_monitoring" - description = "Security group for cron monitoring lambda (used by RDS to allow access in)" - vpc_id = var.cron_monitoring.vpc_id - - egress { - from_port = 0 - to_port = 0 - protocol = "-1" - cidr_blocks = ["0.0.0.0/0"] - ipv6_cidr_blocks = ["::/0"] - } -} - -resource "aws_security_group_rule" "cron_monitoring_to_rds" { - count = var.cron_monitoring == null ? 0 : 1 - type = "ingress" - from_port = 3306 - to_port = 3306 - protocol = "tcp" - source_security_group_id = aws_security_group.cron_monitoring[0].id - security_group_id = var.cron_monitoring.rds_security_group_id -} - -resource "aws_lambda_function" "cron_monitoring" { - count = var.cron_monitoring == null ? 0 : 1 - - depends_on = [ - null_resource.cron_monitoring_build[0], - data.archive_file.cron_monitoring_lambda[0] - ] - - function_name = "${var.customer_prefix}_cron_monitoring" - runtime = "provided.al2" - memory_size = 256 - timeout = 300 - package_type = "Zip" - filename = data.archive_file.cron_monitoring_lambda[0].output_path - source_code_hash = data.archive_file.cron_monitoring_lambda[0].output_base64sha256 - handler = "bootstrap" - reserved_concurrent_executions = 1 - description = "This function has the ability to log into a production database and validate that the Fleet crons are running properly" - tracing_config { - mode = "Active" - } - - vpc_config { - subnet_ids = var.cron_monitoring.subnet_ids - security_group_ids = [aws_security_group.cron_monitoring[0].id] - } - - role = aws_iam_role.cron_monitoring_lambda[0].arn - - environment { - variables = { - MYSQL_HOST = var.cron_monitoring.mysql_host - MYSQL_DATABASE = var.cron_monitoring.mysql_database - MYSQL_USER = var.cron_monitoring.mysql_user - MYSQL_SECRETSMANAGER_SECRET = data.aws_secretsmanager_secret.mysql_database_password[0].name - CRON_SYSTEM_MONITOR_SNS_TOPIC_ARNS = join(",", lookup(var.sns_topic_arns_map, "cron_monitoring", var.default_sns_topic_arns)) - CRON_JOB_FAILURE_MONITOR_SNS_TOPIC_ARNS = join(",", lookup(var.sns_topic_arns_map, "cron_job_failure_monitoring", var.default_sns_topic_arns)) - FLEET_ENV = var.customer_prefix - CRON_DELAY_TOLERANCE = var.cron_monitoring.delay_tolerance - CRON_MONITOR_RUN_INTERVAL = var.cron_monitoring.run_interval - } - } - -} - -// Lambda IAM -data "aws_iam_policy_document" "cron_monitoring_lambda_assume_role" { - statement { - actions = ["sts:AssumeRole"] - principals { - type = "Service" - identifiers = ["lambda.amazonaws.com"] - } - } -} - -resource "aws_iam_role_policy_attachment" "cron_monitoring_lambda" { - count = var.cron_monitoring == null ? 0 : 1 - role = aws_iam_role.cron_monitoring_lambda[0].id - policy_arn = aws_iam_policy.cron_monitoring_lambda[0].arn -} - -resource "aws_iam_role_policy_attachment" "cron_monitoring_lambda_managed" { - count = var.cron_monitoring == null ? 0 : 1 - role = aws_iam_role.cron_monitoring_lambda[0].id - policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaVPCAccessExecutionRole" -} - -resource "aws_iam_policy" "cron_monitoring_lambda" { - count = var.cron_monitoring == null ? 0 : 1 - name = "${var.customer_prefix}-cron-monitoring" - policy = data.aws_iam_policy_document.cron_monitoring_lambda.json -} - -resource "aws_iam_role" "cron_monitoring_lambda" { - count = var.cron_monitoring == null ? 0 : 1 - name = "${var.customer_prefix}-cron-monitoring-lambda" - assume_role_policy = data.aws_iam_policy_document.cron_monitoring_lambda_assume_role.json -} - -data "aws_region" "current" {} -data "aws_caller_identity" "current" {} - -data "aws_iam_policy_document" "cron_monitoring_lambda" { - statement { - - sid = "SSMGetParameterPolicy" - - actions = [ - "secretsmanager:GetResourcePolicy", - "secretsmanager:DescribeSecret", - "secretsmanager:GetSecretValue" - ] - - resources = [data.aws_secretsmanager_secret.mysql_database_password[0].arn] - - effect = "Allow" - - } - - statement { - sid = "SNSPublish" - - actions = [ - "sns:Publish" - ] - - resources = distinct(concat( - lookup(var.sns_topic_arns_map, "cron_monitoring", var.default_sns_topic_arns), - lookup(var.sns_topic_arns_map, "cron_job_failure_monitoring", var.default_sns_topic_arns) - )) - - effect = "Allow" - } - -} - -resource "aws_cloudwatch_log_group" "cron_monitoring_lambda" { - count = var.cron_monitoring == null ? 0 : 1 - name = "/aws/lambda/${var.customer_prefix}-cron-monitoring" - retention_in_days = var.cron_monitoring.log_retention_in_days - -} - -resource "aws_cloudwatch_event_rule" "cron_monitoring_lambda" { - count = var.cron_monitoring == null ? 0 : 1 - name = "${var.customer_prefix}-cron-monitoring" - schedule_expression = "rate(${var.cron_monitoring.run_interval})" - state = "ENABLED" -} - -resource "aws_cloudwatch_event_target" "cron_monitoring_lambda" { - count = var.cron_monitoring == null ? 0 : 1 - rule = aws_cloudwatch_event_rule.cron_monitoring_lambda[0].name - arn = aws_lambda_function.cron_monitoring[0].arn -} - -resource "aws_lambda_permission" "cron_monitoring_cloudwatch" { - count = var.cron_monitoring == null ? 0 : 1 - action = "lambda:InvokeFunction" - function_name = aws_lambda_function.cron_monitoring[0].id - principal = "events.amazonaws.com" - source_arn = aws_cloudwatch_event_rule.cron_monitoring_lambda[0].arn -} diff --git a/terraform/addons/monitoring/variables.tf b/terraform/addons/monitoring/variables.tf deleted file mode 100644 index 4bd494e8701e..000000000000 --- a/terraform/addons/monitoring/variables.tf +++ /dev/null @@ -1,85 +0,0 @@ -variable "customer_prefix" { - type = string - default = "fleet" -} - -variable "fleet_ecs_service_name" { - type = string - default = null -} - -variable "albs" { - type = list(object({ - name = string - arn_suffix = string - target_group_name = string - target_group_arn_suffix = string - min_containers = optional(string, 1) - ecs_service_name = string - alert_thresholds = optional( - object({ - HTTPCode_ELB_5XX_Count = object({ - period = number - threshold = number - }) - HTTPCode_Target_5XX_Count = object({ - period = number - threshold = number - }) - }), - { - HTTPCode_ELB_5XX_Count = { - period = 120 - threshold = 0 - }, - HTTPCode_Target_5XX_Count = { - period = 120 - threshold = 0 - } - } - ) - })) - default = [] -} - - -variable "default_sns_topic_arns" { - type = list(string) - default = [] -} - -variable "sns_topic_arns_map" { - type = map(list(string)) - default = {} -} - -variable "mysql_cluster_members" { - type = list(string) - default = [] -} - -variable "redis_cluster_members" { - type = list(string) - default = [] -} - -variable "acm_certificate_arn" { - type = string - default = null -} - -variable "cron_monitoring" { - type = object({ - mysql_host = string - mysql_database = string - mysql_user = string - mysql_password_secret_name = string - vpc_id = string - subnet_ids = list(string) - rds_security_group_id = string - delay_tolerance = string - run_interval = string - log_retention_in_days = optional(number, 7) - }) - default = null -} diff --git a/terraform/addons/osquery-carve/.header.md b/terraform/addons/osquery-carve/.header.md deleted file mode 100644 index f7cc3d6f23af..000000000000 --- a/terraform/addons/osquery-carve/.header.md +++ /dev/null @@ -1,2 +0,0 @@ -# Osquery Carve Bucket Addon -This addon provides a S3 bucket for Osquery Carve results. diff --git a/terraform/addons/osquery-carve/.terraform-docs.yml b/terraform/addons/osquery-carve/.terraform-docs.yml deleted file mode 100644 index 1d139ddb401d..000000000000 --- a/terraform/addons/osquery-carve/.terraform-docs.yml +++ /dev/null @@ -1 +0,0 @@ -header-from: .header.md diff --git a/terraform/addons/osquery-carve/.terraform.lock.hcl b/terraform/addons/osquery-carve/.terraform.lock.hcl deleted file mode 100644 index d1947fa596bd..000000000000 --- a/terraform/addons/osquery-carve/.terraform.lock.hcl +++ /dev/null @@ -1,24 +0,0 @@ -# This file is maintained automatically by "terraform init". -# Manual edits may be lost in future updates. - -provider "registry.terraform.io/hashicorp/aws" { - version = "5.39.1" - hashes = [ - "h1:hQLlAd6O1LdQHy1GdWtgT5fcOlc3TWW+SaaFkpe+e8E=", - "zh:05c50a5d8edb3ba4ebc4eb6e0d0b5e319142f5983b27821710ed7d475d335bdc", - "zh:082986a5784dd21957e632371b289e549f051a4ea21d5c78c6d744c3537f03c5", - "zh:192ae622ba562eacc4921ed549a794506179233d724fdd15a4f147f3400724a0", - "zh:19a1d4637a62de90b0da174c0bf01000cd900488f7e8f709d8a37f082c59756b", - "zh:1d7689a8583515f1705972d7ce57ccfab96215b19905530d2c78c02dcfaff583", - "zh:22c446a21209a52ab74b4ba1ede0b220531e97ce479430047e493a2c45e1d8cb", - "zh:4154de82290ab4e9f81bac1ea62342de8b3b7a608f99258c190d4dd1c6663e47", - "zh:6bc4859ccdc54f28af9286b2fa090a31dcb345138d68c471510b737f6a052011", - "zh:73c69e000e0b321e78a4a12fef60d37285f2afec0ea7be9e06163d985101cb59", - "zh:890a3422f5e445b49bae30facf448d0ec9cd647e9155d0b685b5b39e9d331a94", - "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", - "zh:9cd88bec0f5205df9032e3126d4e57edd1c5cc8d45cda25626882dafc485a3b0", - "zh:a3a8e3276d0fbf051bbafa192a2998b05745f2cf285ac8c36a9ad167a75c037f", - "zh:d47e4dcf4c0ad71b9a7c720be4f3a89f6786a82e77bbe8d950794562792a1da5", - "zh:f74e5b2af508c7de80a6ae5198df54a795eeba5058a0cd247828943f0c54f6e0", - ] -} diff --git a/terraform/addons/osquery-carve/README.md b/terraform/addons/osquery-carve/README.md deleted file mode 100644 index 304a3859d211..000000000000 --- a/terraform/addons/osquery-carve/README.md +++ /dev/null @@ -1,40 +0,0 @@ -# Osquery Carve Bucket Addon -This addon provides a S3 bucket for Osquery Carve results. - -## Requirements - -No requirements. - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | 5.39.1 | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [aws_iam_policy.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | -| [aws_s3_bucket.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource | -| [aws_s3_bucket_lifecycle_configuration.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource | -| [aws_s3_bucket_public_access_block.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource | -| [aws_s3_bucket_server_side_encryption_configuration.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource | -| [aws_iam_policy_document.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [osquery\_carve\_s3\_bucket](#input\_osquery\_carve\_s3\_bucket) | n/a | 
object({
    name         = optional(string, "fleet-osquery-results-archive")
    expires_days = optional(number, 1)
  })
| 
{
  "expires_days": 1,
  "name": "fleet-osquery-results-archive"
}
| no | - -## Outputs - -| Name | Description | -|------|-------------| -| [fleet\_extra\_environment\_variables](#output\_fleet\_extra\_environment\_variables) | n/a | -| [fleet\_extra\_iam\_policies](#output\_fleet\_extra\_iam\_policies) | n/a | diff --git a/terraform/addons/osquery-carve/main.tf b/terraform/addons/osquery-carve/main.tf deleted file mode 100644 index 94c5fcda7e3b..000000000000 --- a/terraform/addons/osquery-carve/main.tf +++ /dev/null @@ -1,59 +0,0 @@ -// Customer keys are not supported in our Fleet Terraforms at the moment. We will evaluate the -// possibility of providing this capability in the future. -// No versioning on this bucket is by design. -// Bucket logging is not supported in our Fleet Terraforms at the moment. It can be enabled by the -// organizations deploying Fleet, and we will evaluate the possibility of providing this capability -// in the future. - -resource "aws_s3_bucket" "main" { #tfsec:ignore:aws-s3-encryption-customer-key:exp:2022-07-01 #tfsec:ignore:aws-s3-enable-versioning #tfsec:ignore:aws-s3-enable-bucket-logging:exp:2022-06-15 - bucket = var.osquery_carve_s3_bucket.name -} - -resource "aws_s3_bucket_lifecycle_configuration" "main" { - bucket = aws_s3_bucket.main.bucket - rule { - status = "Enabled" - id = "expire" - expiration { - days = var.osquery_carve_s3_bucket.expires_days - } - } -} - -resource "aws_s3_bucket_server_side_encryption_configuration" "main" { - bucket = aws_s3_bucket.main.bucket - rule { - apply_server_side_encryption_by_default { - sse_algorithm = "aws:kms" - } - } -} - -resource "aws_s3_bucket_public_access_block" "main" { - bucket = aws_s3_bucket.main.id - block_public_acls = true - block_public_policy = true - ignore_public_acls = true - restrict_public_buckets = true -} - -data "aws_iam_policy_document" "main" { - statement { - actions = [ - "s3:GetObject*", - "s3:PutObject*", - "s3:ListBucket*", - "s3:ListMultipartUploadParts*", - "s3:DeleteObject", - "s3:CreateMultipartUpload", - "s3:AbortMultipartUpload", - "s3:ListMultipartUploadParts", - "s3:GetBucketLocation" - ] - resources = [aws_s3_bucket.main.arn, "${aws_s3_bucket.main.arn}/*"] - } -} - -resource "aws_iam_policy" "main" { - policy = data.aws_iam_policy_document.main.json -} diff --git a/terraform/addons/osquery-carve/outputs.tf b/terraform/addons/osquery-carve/outputs.tf deleted file mode 100644 index c62c013d1018..000000000000 --- a/terraform/addons/osquery-carve/outputs.tf +++ /dev/null @@ -1,12 +0,0 @@ -output "fleet_extra_environment_variables" { - value = { - FLEET_S3_CARVES_BUCKET = aws_s3_bucket.main.bucket - FLEET_S3_CARVES_PREFIX = "carve_results/" - } -} - -output "fleet_extra_iam_policies" { - value = [ - aws_iam_policy.main.arn - ] -} diff --git a/terraform/addons/osquery-carve/variables.tf b/terraform/addons/osquery-carve/variables.tf deleted file mode 100644 index 9e437c219dcc..000000000000 --- a/terraform/addons/osquery-carve/variables.tf +++ /dev/null @@ -1,10 +0,0 @@ -variable "osquery_carve_s3_bucket" { - type = object({ - name = optional(string, "fleet-osquery-results-archive") - expires_days = optional(number, 1) - }) - default = { - name = "fleet-osquery-results-archive" - expires_days = 1 - } -} diff --git a/terraform/addons/osquery-perf/.header.md b/terraform/addons/osquery-perf/.header.md deleted file mode 100644 index 6ea8ff86a355..000000000000 --- a/terraform/addons/osquery-perf/.header.md +++ /dev/null @@ -1,23 +0,0 @@ -# osquery-perf addon -This addon adds osquery-perf hosts to the Fleet installation. -These are generally used for loadtesting or other testing purposes. See https://github.com/fleetdm/fleet/tree/main/cmd/osquery-perf to learn more about osquery-perf itself. - -This addon creates an AWS Secrets Manager secret that will be used to store the enroll secret that the osquery-perf hosts use to enroll into Fleet. This secret will need to have its `SecretString` populated with the enroll secret manually once everything is setup in order for the osquery-perf hosts to connect. - -Below is an example implementation of the module: - -``` -module "osquery_perf" { - source = "github.com/fleetdm/fleet//terraform/addons/osquery-perf?ref=main" - customer_prefix = "fleet" - ecs_cluster = module.main.byo-vpc.byo-db.byo-ecs.service.cluster - subnets = module.main.byo-vpc.byo-db.byo-ecs.service.network_configuration[0].subnets - security_groups = module.main.byo-vpc.byo-db.byo-ecs.service.network_configuration[0].security_groups - ecs_iam_role_arn = module.main.byo-vpc.byo-db.byo-ecs.iam_role_arn - ecs_execution_iam_role_arn = module.main.byo-vpc.byo-db.byo-ecs.execution_iam_role_arn - server_url = "https://${aws_route53_record.main.fqdn}" - osquery_perf_image = local.osquery_perf_image - extra_flags = ["--os_templates", "mac10.14.6,ubuntu_22.04,windows_11"] - logging_options = module.main.byo-vpc.byo-db.byo-ecs.logging_config -} -``` diff --git a/terraform/addons/osquery-perf/.terraform-docs.yml b/terraform/addons/osquery-perf/.terraform-docs.yml deleted file mode 100644 index 1d139ddb401d..000000000000 --- a/terraform/addons/osquery-perf/.terraform-docs.yml +++ /dev/null @@ -1 +0,0 @@ -header-from: .header.md diff --git a/terraform/addons/osquery-perf/README.md b/terraform/addons/osquery-perf/README.md deleted file mode 100644 index 5c12b14a5a6e..000000000000 --- a/terraform/addons/osquery-perf/README.md +++ /dev/null @@ -1,68 +0,0 @@ -# osquery-perf addon -This addon adds osquery-perf hosts to the Fleet installation. -These are generally used for loadtesting or other testing purposes. See https://github.com/fleetdm/fleet/tree/main/cmd/osquery-perf to learn more about osquery-perf itself. - -This addon creates an AWS Secrets Manager secret that will be used to store the enroll secret that the osquery-perf hosts use to enroll into Fleet. This secret will need to have its `SecretString` populated with the enroll secret manually once everything is setup in order for the osquery-perf hosts to connect. - -Below is an example implementation of the module: - -``` -module "osquery_perf" { - source = "github.com/fleetdm/fleet//terraform/addons/osquery-perf?ref=main" - customer_prefix = "fleet" - ecs_cluster = module.main.byo-vpc.byo-db.byo-ecs.service.cluster - subnets = module.main.byo-vpc.byo-db.byo-ecs.service.network_configuration[0].subnets - security_groups = module.main.byo-vpc.byo-db.byo-ecs.service.network_configuration[0].security_groups - ecs_iam_role_arn = module.main.byo-vpc.byo-db.byo-ecs.iam_role_arn - ecs_execution_iam_role_arn = module.main.byo-vpc.byo-db.byo-ecs.execution_iam_role_arn - server_url = "https://${aws_route53_record.main.fqdn}" - osquery_perf_image = local.osquery_perf_image - extra_flags = ["--os_templates", "mac10.14.6,ubuntu_22.04,windows_11"] - logging_options = module.main.byo-vpc.byo-db.byo-ecs.logging_config -} -``` - -## Requirements - -No requirements. - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | n/a | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [aws_ecs_service.osquery_perf](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_service) | resource | -| [aws_ecs_task_definition.osquery_perf](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_task_definition) | resource | -| [aws_kms_alias.enroll_secret](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_alias) | resource | -| [aws_kms_key.enroll_secret](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource | -| [aws_secretsmanager_secret.enroll_secret](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource | -| [aws_secretsmanager_secret_version.enroll_secret](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/secretsmanager_secret_version) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [customer\_prefix](#input\_customer\_prefix) | customer prefix to use to namespace all resources | `string` | `"fleet"` | no | -| [ecs\_cluster](#input\_ecs\_cluster) | n/a | `string` | n/a | yes | -| [ecs\_execution\_iam\_role\_arn](#input\_ecs\_execution\_iam\_role\_arn) | n/a | `string` | n/a | yes | -| [ecs\_iam\_role\_arn](#input\_ecs\_iam\_role\_arn) | n/a | `string` | n/a | yes | -| [extra\_flags](#input\_extra\_flags) | n/a | `list(string)` | `[]` | no | -| [loadtest\_containers](#input\_loadtest\_containers) | n/a | `number` | `1` | no | -| [logging\_options](#input\_logging\_options) | n/a | 
object({
    awslogs-group         = string
    awslogs-region        = string
    awslogs-stream-prefix = string
  })
| n/a | yes | -| [osquery\_perf\_image](#input\_osquery\_perf\_image) | n/a | `string` | n/a | yes | -| [security\_groups](#input\_security\_groups) | n/a | `list(string)` | n/a | yes | -| [server\_url](#input\_server\_url) | n/a | `string` | n/a | yes | -| [subnets](#input\_subnets) | n/a | `list(string)` | n/a | yes | - -## Outputs - -No outputs. diff --git a/terraform/addons/osquery-perf/main.tf b/terraform/addons/osquery-perf/main.tf deleted file mode 100644 index 2c2c010f4b7a..000000000000 --- a/terraform/addons/osquery-perf/main.tf +++ /dev/null @@ -1,79 +0,0 @@ -resource "aws_kms_key" "enroll_secret" { - deletion_window_in_days = 10 - enable_key_rotation = true -} - -resource "aws_kms_alias" "enroll_secret" { - name_prefix = "alias/${var.customer_prefix}-enroll-secret-key" - target_key_id = aws_kms_key.enroll_secret.key_id -} - -resource "aws_secretsmanager_secret" "enroll_secret" { - name_prefix = "${var.customer_prefix}-enroll-secret" - kms_key_id = aws_kms_key.enroll_secret.arn -} - -data "aws_secretsmanager_secret_version" "enroll_secret" { - secret_id = aws_secretsmanager_secret.enroll_secret.id -} - -resource "aws_ecs_task_definition" "osquery_perf" { - family = "${var.customer_prefix}-osquery-perf" - network_mode = "awsvpc" - requires_compatibilities = ["FARGATE"] - execution_role_arn = var.ecs_execution_iam_role_arn - task_role_arn = var.ecs_iam_role_arn - cpu = 256 - memory = 1024 - container_definitions = jsonencode( - [ - { - name = "osquery-perf" - image = var.osquery_perf_image - cpu = 256 - memory = 512 - mountPoints = [] - volumesFrom = [] - essential = true - ulimits = [ - { - softLimit = 9999, - hardLimit = 9999, - name = "nofile" - } - ] - networkMode = "awsvpc" - logConfiguration = { - logDriver = "awslogs" - options = var.logging_options - } - workingDirectory = "/go", - command = concat([ - "/go/osquery-perf", - "-enroll_secret", data.aws_secretsmanager_secret_version.enroll_secret.secret_string, - "-host_count", "500", - "-server_url", var.server_url, - "--policy_pass_prob", "0.5", - "--start_period", "5m", - ], var.extra_flags) - } - ]) - lifecycle { - create_before_destroy = true - } -} - -resource "aws_ecs_service" "osquery_perf" { - name = "osquery_perf" - launch_type = "FARGATE" - cluster = var.ecs_cluster - task_definition = aws_ecs_task_definition.osquery_perf.arn - desired_count = var.loadtest_containers - deployment_minimum_healthy_percent = 100 - deployment_maximum_percent = 200 - - network_configuration { - subnets = var.subnets - security_groups = var.security_groups - } -} diff --git a/terraform/addons/osquery-perf/variables.tf b/terraform/addons/osquery-perf/variables.tf deleted file mode 100644 index 6348a33c6f57..000000000000 --- a/terraform/addons/osquery-perf/variables.tf +++ /dev/null @@ -1,53 +0,0 @@ -variable "customer_prefix" { - type = string - description = "customer prefix to use to namespace all resources" - default = "fleet" -} - -variable "ecs_cluster" { - type = string -} - -variable "ecs_execution_iam_role_arn" { - type = string -} - -variable "ecs_iam_role_arn" { - type = string -} - -variable "extra_flags" { - type = list(string) - default = [] -} - -variable "loadtest_containers" { - type = number - default = 1 -} - -variable "logging_options" { - type = object({ - awslogs-group = string - awslogs-region = string - awslogs-stream-prefix = string - }) -} - -variable "osquery_perf_image" { - type = string -} - -variable "security_groups" { - type = list(string) - nullable = false -} - -variable "server_url" { - type = string -} - -variable "subnets" { - type = list(string) - nullable = false -} diff --git a/terraform/addons/private-registry/.header.md b/terraform/addons/private-registry/.header.md deleted file mode 100644 index 289b7a8f28d5..000000000000 --- a/terraform/addons/private-registry/.header.md +++ /dev/null @@ -1,33 +0,0 @@ -# Private Container Image Registry - -This addon will provision the correct IAM policy to attach to the Fleet config for the ECS task definition -to utilize private registry credentials when pulling container images. - -## Using a private container image repository - -First create an AWS Secrets Manager Secret with your preferred method, for example: -```shell -aws secretsmanager create-secret --name MyRegistryCredentials \ - --description "Private registry credentials" \ - --secret-string '{"username":"","password":""}' -``` - -Then provide this secret's ARN as the input to the variable `secret_arn`. - -### Using in Fleet Config - -```hcl -module "private-auth" { - source = "github.com/fleetdm/fleet//terraform/addons/private-registry" - secret_arn = "arn:aws:secretsmanager:us-east-2:123456789:secret:MyRegistryCredentials" -} - -module "main" { - source = "github.com/fleetdm/fleet//terraform" - fleet_config = { - # other fleet configs - extra_execution_iam_policies = concat(module.private-auth.extra_execution_iam_policies /*, additional execution policies*/) - repository_credentials = "arn:aws:secretsmanager:us-east-2:123456789:secret:MyRegistryCredentials" - } -} -``` diff --git a/terraform/addons/private-registry/.terraform-docs.yml b/terraform/addons/private-registry/.terraform-docs.yml deleted file mode 100644 index 1d139ddb401d..000000000000 --- a/terraform/addons/private-registry/.terraform-docs.yml +++ /dev/null @@ -1 +0,0 @@ -header-from: .header.md diff --git a/terraform/addons/private-registry/README.md b/terraform/addons/private-registry/README.md deleted file mode 100644 index a0a0de25d55a..000000000000 --- a/terraform/addons/private-registry/README.md +++ /dev/null @@ -1,67 +0,0 @@ -# Private Container Image Registry - -This addon will provision the correct IAM policy to attach to the Fleet config for the ECS task definition -to utilize private registry credentials when pulling container images. - -## Using a private container image repository - -First create an AWS Secrets Manager Secret with your preferred method, for example: -```shell -aws secretsmanager create-secret --name MyRegistryCredentials \ - --description "Private registry credentials" \ - --secret-string '{"username":"","password":""}' -``` - -Then provide this secret's ARN as the input to the variable `secret_arn`. - -### Using in Fleet Config - -```hcl -module "private-auth" { - source = "github.com/fleetdm/fleet//terraform/addons/private-registry" - secret_arn = "arn:aws:secretsmanager:us-east-2:123456789:secret:MyRegistryCredentials" -} - -module "main" { - source = "github.com/fleetdm/fleet//terraform" - fleet_config = { - # other fleet configs - extra_execution_iam_policies = concat(module.private-auth.extra_execution_iam_policies /*, additional execution policies*/) - repository_credentials = "arn:aws:secretsmanager:us-east-2:123456789:secret:MyRegistryCredentials" - } -} -``` - -## Requirements - -No requirements. - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | n/a | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [aws_iam_policy.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | -| [aws_iam_policy_document.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [secret\_arn](#input\_secret\_arn) | ARN of the AWS Secrets Manager secret that stores the private registry credentials | `string` | n/a | yes | - -## Outputs - -| Name | Description | -|------|-------------| -| [extra\_execution\_iam\_policies](#output\_extra\_execution\_iam\_policies) | n/a | -| [secret\_arn](#output\_secret\_arn) | n/a | diff --git a/terraform/addons/private-registry/main.tf b/terraform/addons/private-registry/main.tf deleted file mode 100644 index f3d70cd058ac..000000000000 --- a/terraform/addons/private-registry/main.tf +++ /dev/null @@ -1,17 +0,0 @@ -data "aws_iam_policy_document" "main" { - statement { - effect = "Allow" - - actions = [ - "secretsmanager:GetSecretValue", - ] - - resources = [ - var.secret_arn - ] - } -} - -resource "aws_iam_policy" "main" { - policy = data.aws_iam_policy_document.main.json -} \ No newline at end of file diff --git a/terraform/addons/private-registry/outputs.tf b/terraform/addons/private-registry/outputs.tf deleted file mode 100644 index 2ae684dc6cc9..000000000000 --- a/terraform/addons/private-registry/outputs.tf +++ /dev/null @@ -1,9 +0,0 @@ -output "extra_execution_iam_policies" { - value = [ - aws_iam_policy.main.arn - ] -} - -output "secret_arn" { - value = var.secret_arn -} \ No newline at end of file diff --git a/terraform/addons/private-registry/variables.tf b/terraform/addons/private-registry/variables.tf deleted file mode 100644 index b6cbd32d6540..000000000000 --- a/terraform/addons/private-registry/variables.tf +++ /dev/null @@ -1,4 +0,0 @@ -variable "secret_arn" { - type = string - description = "ARN of the AWS Secrets Manager secret that stores the private registry credentials" -} diff --git a/terraform/addons/saml-auth-proxy/README.md b/terraform/addons/saml-auth-proxy/README.md deleted file mode 100644 index baaa39bac427..000000000000 --- a/terraform/addons/saml-auth-proxy/README.md +++ /dev/null @@ -1,60 +0,0 @@ -## Requirements - -No requirements. - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | 5.17.0 | - -## Modules - -| Name | Source | Version | -|------|--------|---------| -| [saml\_auth\_proxy\_alb](#module\_saml\_auth\_proxy\_alb) | terraform-aws-modules/alb/aws | 8.2.1 | - -## Resources - -| Name | Type | -|------|------| -| [aws_cloudwatch_log_group.saml_auth_proxy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource | -| [aws_ecs_service.saml_auth_proxy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_service) | resource | -| [aws_ecs_task_definition.saml_auth_proxy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_task_definition) | resource | -| [aws_iam_policy.saml_auth_proxy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | -| [aws_secretsmanager_secret.saml_auth_proxy_cert](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource | -| [aws_security_group.saml_auth_proxy_alb](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource | -| [aws_security_group.saml_auth_proxy_service](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource | -| [aws_iam_policy_document.saml_auth_proxy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [alb\_access\_logs](#input\_alb\_access\_logs) | n/a | `map(string)` | `{}` | no | -| [alb\_target\_group\_arn](#input\_alb\_target\_group\_arn) | n/a | `string` | n/a | yes | -| [base\_url](#input\_base\_url) | n/a | `string` | n/a | yes | -| [cookie\_max\_age](#input\_cookie\_max\_age) | n/a | `string` | `"1h"` | no | -| [customer\_prefix](#input\_customer\_prefix) | customer prefix to use to namespace all resources | `string` | `"fleet"` | no | -| [ecs\_cluster](#input\_ecs\_cluster) | n/a | `string` | n/a | yes | -| [ecs\_execution\_iam\_role\_arn](#input\_ecs\_execution\_iam\_role\_arn) | n/a | `string` | n/a | yes | -| [ecs\_iam\_role\_arn](#input\_ecs\_iam\_role\_arn) | n/a | `string` | n/a | yes | -| [idp\_metadata\_url](#input\_idp\_metadata\_url) | n/a | `string` | n/a | yes | -| [logging\_options](#input\_logging\_options) | n/a | 
object({
    awslogs-group         = string
    awslogs-region        = string
    awslogs-stream-prefix = string
  })
| n/a | yes | -| [proxy\_containers](#input\_proxy\_containers) | n/a | `number` | `1` | no | -| [saml\_auth\_proxy\_image](#input\_saml\_auth\_proxy\_image) | n/a | `string` | `"itzg/saml-auth-proxy:1.12.0@sha256:ddff17caa00c1aad64d6c7b2e1d5eb93d97321c34d8ad12a25cfd8ce203db723"` | no | -| [security\_groups](#input\_security\_groups) | n/a | `list(string)` | n/a | yes | -| [subnets](#input\_subnets) | n/a | `list(string)` | n/a | yes | -| [vpc\_id](#input\_vpc\_id) | n/a | `string` | n/a | yes | - -## Outputs - -| Name | Description | -|------|-------------| -| [fleet\_extra\_execution\_policies](#output\_fleet\_extra\_execution\_policies) | n/a | -| [lb](#output\_lb) | n/a | -| [lb\_security\_group](#output\_lb\_security\_group) | n/a | -| [lb\_target\_group\_arn](#output\_lb\_target\_group\_arn) | Keep for legacy support for now | -| [name](#output\_name) | n/a | -| [secretsmanager\_secret\_id](#output\_secretsmanager\_secret\_id) | n/a | diff --git a/terraform/addons/saml-auth-proxy/files/saml-auth-proxy.sh b/terraform/addons/saml-auth-proxy/files/saml-auth-proxy.sh deleted file mode 100644 index e3c5db8ecbf6..000000000000 --- a/terraform/addons/saml-auth-proxy/files/saml-auth-proxy.sh +++ /dev/null @@ -1,5 +0,0 @@ -mkdir -p $(dirname ${SAML_PROXY_SP_CERT_PATH:?}) -mkdir -p $(dirname ${SAML_PROXY_SP_KEY_PATH:?}) -echo "${SAML_PROXY_SP_CERT_BYTES:?}" > "${SAML_PROXY_SP_CERT_PATH:?}" -echo "${SAML_PROXY_SP_KEY_BYTES:?}" > "${SAML_PROXY_SP_KEY_PATH:?}" -/usr/bin/saml-auth-proxy diff --git a/terraform/addons/saml-auth-proxy/main.tf b/terraform/addons/saml-auth-proxy/main.tf deleted file mode 100644 index 6daa975d441a..000000000000 --- a/terraform/addons/saml-auth-proxy/main.tf +++ /dev/null @@ -1,229 +0,0 @@ -data "aws_region" "current" {} - -resource "aws_cloudwatch_log_group" "saml_auth_proxy" { - name = "${var.customer_prefix}-saml-auth-proxy" -} - -data "aws_iam_policy_document" "saml_auth_proxy" { - // allow saml_auth_proxy to obtain certs from secrets manager - statement { - effect = "Allow" - actions = ["secretsmanager:GetSecretValue"] - resources = [aws_secretsmanager_secret.saml_auth_proxy_cert.arn] - } -} - -resource "aws_iam_policy" "saml_auth_proxy" { - name = "${var.customer_prefix}-saml-auth-proxy" - description = "IAM Policy to provide saml_auth_proxy access to secrets" - policy = data.aws_iam_policy_document.saml_auth_proxy.json -} - -resource "aws_secretsmanager_secret" "saml_auth_proxy_cert" { - name_prefix = "${var.customer_prefix}-saml-auth-proxy-cert" -} - -resource "aws_security_group" "saml_auth_proxy_alb" { - #checkov:skip=CKV2_AWS_5:False positive - vpc_id = var.vpc_id - description = "Fleet ALB Security Group" - - ingress { - description = "Internal HTTP back to Fleet" - from_port = 8080 - to_port = 8080 - protocol = "tcp" - security_groups = [aws_security_group.saml_auth_proxy_service.id] - } - - egress { - description = "Egress to all" - from_port = 0 - to_port = 0 - protocol = "-1" - cidr_blocks = ["0.0.0.0/0"] - ipv6_cidr_blocks = [] - } -} - -resource "aws_security_group" "saml_auth_proxy_service" { - #checkov:skip=CKV2_AWS_5:False positive - vpc_id = var.vpc_id - description = "Fleet ALB Security Group" - - ingress { - description = "Internal HTTP back to Fleet" - from_port = 8080 - to_port = 8080 - protocol = "tcp" - cidr_blocks = ["10.0.0.0/8"] - } - - egress { - description = "Egress to all" - from_port = 0 - to_port = 0 - protocol = "-1" - cidr_blocks = ["0.0.0.0/0"] - ipv6_cidr_blocks = [] - } -} - - -module "saml_auth_proxy_alb" { - source = "terraform-aws-modules/alb/aws" - version = "8.2.1" - - name = "${var.customer_prefix}-saml-auth-proxy" - - load_balancer_type = "application" - - vpc_id = var.vpc_id - subnets = var.subnets - security_groups = [aws_security_group.saml_auth_proxy_alb.id] - # FIXME: Get this working eventually. - access_logs = var.alb_access_logs - - internal = true - target_groups = [ - { - name = "${var.customer_prefix}-saml-to-fleet" - backend_protocol = "HTTP" - backend_port = 8080 - target_type = "ip" - health_check = { - path = "/healthz" - matcher = "200" - timeout = 10 - interval = 15 - healthy_threshold = 5 - unhealthy_threshold = 5 - } - } - ] - - http_tcp_listeners = [ - { - port = 8080 - protocol = "HTTP" - target_group_index = 0 - } - ] -} - -resource "aws_ecs_task_definition" "saml_auth_proxy" { - family = "${var.customer_prefix}-saml-auth-proxy" - network_mode = "awsvpc" - requires_compatibilities = ["FARGATE"] - execution_role_arn = var.ecs_execution_iam_role_arn - task_role_arn = var.ecs_iam_role_arn - cpu = 256 - memory = 1024 - container_definitions = jsonencode( - [ - { - name = "${var.customer_prefix}-saml-auth-proxy" - image = var.saml_auth_proxy_image - cpu = 256 - memory = 512 - mountPoints = [] - volumesFrom = [] - essential = true - ulimits = [ - { - softLimit = 9999, - hardLimit = 9999, - name = "nofile" - } - ] - portMappings = [ - { - # This port is the same that the contained application also uses - containerPort = 8080 - protocol = "tcp" - } - ] - networkMode = "awsvpc" - logConfiguration = { - logDriver = "awslogs" - options = var.logging_options != null ? var.logging_options : { - awslogs-group = "${var.customer_prefix}-saml-auth-proxy" - awslogs-region = data.aws_region.current.name - awslogs-stream-prefix = "saml-auth-proxy" - } - } - workingDirectory = "/go", - secrets = [ - { - name = "SAML_PROXY_SP_CERT_BYTES" - valueFrom = "${aws_secretsmanager_secret.saml_auth_proxy_cert.arn}:cert::" - }, - { - name = "SAML_PROXY_SP_KEY_BYTES" - valueFrom = "${aws_secretsmanager_secret.saml_auth_proxy_cert.arn}:key::" - }, - ] - environment = [ - { - name = "SAML_PROXY_SP_CERT_PATH" - value = "/tmp/saml-auth-proxy/cert.pem" - }, - { - name = "SAML_PROXY_SP_KEY_PATH" - value = "/tmp/saml-auth-proxy/key.pem" - }, - { - name = "SAML_PROXY_BACKEND_URL" - value = "http://${module.saml_auth_proxy_alb.lb_dns_name}:8080/" - }, - { - name = "SAML_PROXY_IDP_METADATA_URL" - value = var.idp_metadata_url - }, - { - name = "SAML_PROXY_BASE_URL" - value = var.base_url - }, - { - name = "SAML_PROXY_COOKIE_MAX_AGE" - value = var.cookie_max_age - }, - { - name = "SAML_PROXY_COOKIE_NAME" - value = "saml_auth_proxy_token" - }, - { - name = "SAML_PROXY_ALLOW_IDP_INITIATED" - value = "true" - }, - ] - entryPoint = ["/bin/sh"], - command = ["-c", file("${path.module}/files/saml-auth-proxy.sh")] - } - ] - ) - lifecycle { - create_before_destroy = true - } -} - -resource "aws_ecs_service" "saml_auth_proxy" { - name = "${var.customer_prefix}_saml_auth_proxy" - launch_type = "FARGATE" - cluster = var.ecs_cluster - task_definition = aws_ecs_task_definition.saml_auth_proxy.arn - desired_count = var.proxy_containers - deployment_minimum_healthy_percent = 100 - deployment_maximum_percent = 200 - - network_configuration { - subnets = var.subnets - security_groups = [aws_security_group.saml_auth_proxy_service.id] - } - - load_balancer { - target_group_arn = var.alb_target_group_arn - container_name = "${var.customer_prefix}-saml-auth-proxy" - container_port = 8080 - } -} diff --git a/terraform/addons/saml-auth-proxy/outputs.tf b/terraform/addons/saml-auth-proxy/outputs.tf deleted file mode 100644 index afc268f9c812..000000000000 --- a/terraform/addons/saml-auth-proxy/outputs.tf +++ /dev/null @@ -1,26 +0,0 @@ -output "fleet_extra_execution_policies" { - value = [ - aws_iam_policy.saml_auth_proxy.arn - ] -} - -output "name" { - value = "${var.customer_prefix}-saml-auth-proxy" -} - -# Keep for legacy support for now -output "lb_target_group_arn" { - value = module.saml_auth_proxy_alb.target_group_arns[0] -} - -output "lb" { - value = module.saml_auth_proxy_alb -} - -output "lb_security_group" { - value = aws_security_group.saml_auth_proxy_alb.id -} - -output "secretsmanager_secret_id" { - value = aws_secretsmanager_secret.saml_auth_proxy_cert.id -} diff --git a/terraform/addons/saml-auth-proxy/variables.tf b/terraform/addons/saml-auth-proxy/variables.tf deleted file mode 100644 index f441c643e362..000000000000 --- a/terraform/addons/saml-auth-proxy/variables.tf +++ /dev/null @@ -1,76 +0,0 @@ -variable "cookie_max_age" { - type = string - default = "1h" -} - -variable "alb_target_group_arn" { - type = string -} - -variable "alb_access_logs" { - type = map(string) - default = {} -} - -# variable "public_alb_security_group_id" { -# type = string -# } - -variable "idp_metadata_url" { - type = string -} - -variable "customer_prefix" { - type = string - description = "customer prefix to use to namespace all resources" - default = "fleet" -} - -variable "ecs_cluster" { - type = string -} - -variable "ecs_execution_iam_role_arn" { - type = string -} - -variable "ecs_iam_role_arn" { - type = string -} - -variable "proxy_containers" { - type = number - default = 1 -} - -variable "logging_options" { - type = object({ - awslogs-group = string - awslogs-region = string - awslogs-stream-prefix = string - }) -} - -variable "saml_auth_proxy_image" { - type = string - default = "itzg/saml-auth-proxy:1.12.0@sha256:ddff17caa00c1aad64d6c7b2e1d5eb93d97321c34d8ad12a25cfd8ce203db723" -} - -variable "security_groups" { - type = list(string) - nullable = false -} - -variable "base_url" { - type = string -} - -variable "subnets" { - type = list(string) - nullable = false -} - -variable "vpc_id" { - type = string - nullable = false -} diff --git a/terraform/addons/ses/.header.md b/terraform/addons/ses/.header.md deleted file mode 100644 index fd1edec28861..000000000000 --- a/terraform/addons/ses/.header.md +++ /dev/null @@ -1,2 +0,0 @@ -# SES Mailing Addon -This addon allows Fleet to send password resets via SES diff --git a/terraform/addons/ses/.terraform-docs.yml b/terraform/addons/ses/.terraform-docs.yml deleted file mode 100644 index 1d139ddb401d..000000000000 --- a/terraform/addons/ses/.terraform-docs.yml +++ /dev/null @@ -1 +0,0 @@ -header-from: .header.md diff --git a/terraform/addons/ses/README.md b/terraform/addons/ses/README.md deleted file mode 100644 index 5b2f1caece21..000000000000 --- a/terraform/addons/ses/README.md +++ /dev/null @@ -1,42 +0,0 @@ -# SES Mailing Addon -This addon allows Fleet to send password resets via SES - -## Requirements - -No requirements. - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | 4.62.2 | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [aws_iam_policy.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | -| [aws_route53_record.amazonses_dkim_record](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record) | resource | -| [aws_route53_record.spf_domain](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/route53_record) | resource | -| [aws_ses_domain_dkim.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ses_domain_dkim) | resource | -| [aws_ses_domain_identity.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ses_domain_identity) | resource | -| [aws_iam_policy_document.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [domain](#input\_domain) | Domain to use for SES. | `string` | n/a | yes | -| [extra\_txt\_records](#input\_extra\_txt\_records) | Extra TXT records that have to match the same name as the Fleet instance | `list(string)` | `[]` | no | -| [zone\_id](#input\_zone\_id) | Route53 Zone ID | `string` | n/a | yes | - -## Outputs - -| Name | Description | -|------|-------------| -| [fleet\_extra\_environment\_variables](#output\_fleet\_extra\_environment\_variables) | n/a | -| [fleet\_extra\_iam\_policies](#output\_fleet\_extra\_iam\_policies) | n/a | diff --git a/terraform/addons/ses/main.tf b/terraform/addons/ses/main.tf deleted file mode 100644 index 9341d540b7d5..000000000000 --- a/terraform/addons/ses/main.tf +++ /dev/null @@ -1,56 +0,0 @@ -locals { - spf_domains = [ - aws_ses_domain_identity.default.domain, - "_amazonses.${aws_ses_domain_identity.default.domain}" - ] -} - -resource "aws_ses_domain_identity" "default" { - domain = var.domain -} - -resource "aws_ses_domain_dkim" "default" { - domain = aws_ses_domain_identity.default.domain -} - -###DKIM VERIFICATION####### - -resource "aws_route53_record" "amazonses_dkim_record" { - count = 3 // no clue why this is three, but multiple modules all did the same thing - zone_id = var.zone_id - name = "${element(aws_ses_domain_dkim.default.dkim_tokens, count.index)}._domainkey.${var.domain}" - type = "CNAME" - ttl = "600" - records = ["${element(aws_ses_domain_dkim.default.dkim_tokens, count.index)}.dkim.amazonses.com"] -} - - -resource "aws_route53_record" "spf_domain" { - for_each = toset(local.spf_domains) - zone_id = var.zone_id - name = each.key - type = "TXT" - ttl = "600" - records = each.key == aws_ses_domain_identity.default.domain ? flatten([["v=spf1 include:amazonses.com -all"], var.extra_txt_records]) : ["v=spf1 include:amazonses.com -all"] -} - -resource "aws_iam_policy" "main" { - policy = data.aws_iam_policy_document.main.json -} - -data "aws_iam_policy_document" "main" { - statement { - actions = [ - "ses:SendEmail", - "ses:SendRawEmail", - ] - resources = ["*"] - condition { - test = "StringLike" - variable = "ses:FromAddress" - values = [ - "*@${var.domain}" - ] - } - } -} diff --git a/terraform/addons/ses/outputs.tf b/terraform/addons/ses/outputs.tf deleted file mode 100644 index 0e22664378f0..000000000000 --- a/terraform/addons/ses/outputs.tf +++ /dev/null @@ -1,12 +0,0 @@ -output "fleet_extra_environment_variables" { - value = { - FLEET_EMAIL_BACKEND = "ses" - FLEET_SES_SOURCE_ARN = aws_ses_domain_identity.default.arn - } -} - -output "fleet_extra_iam_policies" { - value = [ - aws_iam_policy.main.arn - ] -} diff --git a/terraform/addons/ses/variables.tf b/terraform/addons/ses/variables.tf deleted file mode 100644 index 3620621d3c2e..000000000000 --- a/terraform/addons/ses/variables.tf +++ /dev/null @@ -1,15 +0,0 @@ -variable "domain" { - type = string - description = "Domain to use for SES." -} - -variable "zone_id" { - type = string - description = "Route53 Zone ID" -} - -variable "extra_txt_records" { - type = list(string) - description = "Extra TXT records that have to match the same name as the Fleet instance" - default = [] -} diff --git a/terraform/addons/vuln-processing/README.md b/terraform/addons/vuln-processing/README.md deleted file mode 100644 index 202f212c0eca..000000000000 --- a/terraform/addons/vuln-processing/README.md +++ /dev/null @@ -1,79 +0,0 @@ -# vulnerability processing addon -This addon adds [external vulnerability processing](https://fleetdm.com/docs/using-fleet/vulnerability-processing#advanced-configuration) to the Fleet deployment. - -Be sure to set `FLEET_VULNERABILITIES_DISABLE_SCHEDULE = "true"` or use this modules' `fleet_extra_environment_variables` output to configure -your Fleet server deployment. - -Below is an example implementation of the module: - -``` -module "vulnerability_processing" { - source = "github.com/fleetdm/fleet//terraform/addons/vuln-processing?ref=main" - customer_prefix = "fleet" - ecs_cluster = module.main.byo-vpc.byo-db.byo-ecs.cluster.cluster_arn - vpc_id = module.main.vpc.vpc_id - fleet_config = { - image = "fleetdm/fleet:v4.31.1" - database = { - password_secret_arn = module.main.byo-vpc.secrets.secret_arns["${var.rds_config.name}-database-password"] - user = module.main.byo-vpc.rds.db_instance_username - address = "${module.main.byo-vpc.rds.db_instance_endpoint}:${module.main.byo-vpc.rds.db_instance_port}" - database = module.main.byo-vpc.rds.db_instance_name - } - extra_environment_variables = { - FLEET_LOGGING_DEBUG = "true" - FLEET_LOGGING_JSON = "true" - } - extra_secrets = { - // FLEET_LICENSE_KEY: "secret_manager_license_key_arn" // note needed for some feature of vuln processing - } - networking = { - subnets = module.main.byo-vpc.byo-db.byo-ecs.service.network_configuration[0].subnets - security_groups = module.main.byo-vpc.byo-db.byo-ecs.service.network_configuration[0].security_groups - } - } -} -``` - -## Requirements - -[VPC DNS Hostnames](https://docs.aws.amazon.com/vpc/latest/userguide/vpc-dns.html#vpc-dns-hostnames) must be enabled for proper communication to EFS mounted volumes. - -## Providers - -| Name | Version | -|---------------------------------------------------|---------| -| [aws](#provider\_aws) | n/a | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|----------------------------------------------------------------------------------------------------------------------------------------------------|----------| -| [aws_ecs_task_definition.vuln-data-stream](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_task_definition) | resource | -| [aws_ecs_task_definition.vuln-processing](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_task_definition) | resource | -| [aws_efs_file_system.vuln](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/efs_file_system) | resource | -| [aws_efs_mount_target.vuln](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/efs_mount_target) | resource | -| [aws_cloudwatch_event_rule.vuln_processing](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource | -| [aws_cloudwatch_event_target.vuln_processing](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource | -| [aws_security_group.efs_security_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource | -| [aws_iam_role.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | -| [aws_iam_role_policy_attachment.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy_attachment) | resource | -| [aws_iam_role.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | - - -## Inputs - -| Name | Description | Type | Default | Required | -|-----------------------------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------|----------|-----------|:--------:| -| [customer\_prefix](#input\_customer\_prefix) | customer prefix to use to namespace all resources | `string` | `"fleet"` | no | -| [ecs\_cluster](#input\_ecs\_cluster) | ECS cluster ARN | `string` | n/a | yes | -| [vpc\_id](#input\_vpc\_id) | n/a | `string` | n/a | yes | -| [fleet\_config](#input\_fleet\_config) | The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified. | `object` | no | yes | - -## Outputs - -No outputs. diff --git a/terraform/addons/vuln-processing/efs.tf b/terraform/addons/vuln-processing/efs.tf deleted file mode 100644 index ea9f1ebf9cac..000000000000 --- a/terraform/addons/vuln-processing/efs.tf +++ /dev/null @@ -1,20 +0,0 @@ -resource "aws_efs_file_system" "vuln" {} - -resource "aws_security_group" "efs_security_group" { - name_prefix = "${var.customer_prefix}-efs-mount-sg" - vpc_id = var.vpc_id - - // NFS - ingress { - from_port = 2049 - to_port = 2049 - protocol = "tcp" - security_groups = var.fleet_config.networking.security_groups # Allow traffic from the ECS task security group - } -} - -resource "aws_efs_mount_target" "vuln" { - for_each = var.fleet_config.networking.subnets - file_system_id = aws_efs_file_system.vuln.id - subnet_id = each.value -} \ No newline at end of file diff --git a/terraform/addons/vuln-processing/iam.tf b/terraform/addons/vuln-processing/iam.tf deleted file mode 100644 index 78a4dc26a98b..000000000000 --- a/terraform/addons/vuln-processing/iam.tf +++ /dev/null @@ -1,132 +0,0 @@ -data "aws_iam_policy_document" "fleet-execution" { - // allow fleet application to obtain the database password from secrets manager - statement { - effect = "Allow" - actions = ["secretsmanager:GetSecretValue"] - resources = concat(var.fleet_config.database.password_secret_arn, values(var.fleet_config.extra_secrets)) - } -} - -data "aws_iam_policy_document" "fleet" { - statement { - effect = "Allow" - actions = ["cloudwatch:PutMetricData"] - resources = ["*"] - } - - statement { - effect = "Allow" - actions = [ - "elasticfilesystem:ClientMount", - "elasticfilesystem:ClientWrite", - "elasticfilesystem:ClientRead", - ] - resources = [aws_efs_file_system.vuln.arn] - } -} - - - -data "aws_iam_policy_document" "assume_events" { - statement { - effect = "Allow" - actions = ["sts:AssumeRole"] - - principals { - type = "Service" - identifiers = ["events.amazonaws.com", "ecs-tasks.amazonaws.com"] - } - } -} - -data "aws_iam_policy_document" "cloudwatch_task" { - statement { - effect = "Allow" - actions = ["iam:PassRole"] - resources = ["*"] - } - - statement { - effect = "Allow" - actions = ["ecs:RunTask"] - resources = ["*"] - condition { - test = "ArnEquals" - variable = "ecs:cluster" - values = [var.ecs_cluster] - } - } -} - -resource "aws_iam_role" "main" { - count = var.fleet_config.iam_role_arn == null ? 1 : 0 - name = var.fleet_config.iam.role.name - description = "IAM role that Fleet application assumes when running in ECS" - assume_role_policy = data.aws_iam_policy_document.assume_events.json -} - -resource "aws_iam_policy" "main" { - count = var.fleet_config.iam_role_arn == null ? 1 : 0 - name = var.fleet_config.iam.role.policy_name - description = "IAM policy that Fleet application uses to define access to AWS resources" - policy = data.aws_iam_policy_document.fleet.json -} - -resource "aws_iam_role_policy_attachment" "main" { - count = var.fleet_config.iam_role_arn == null ? 1 : 0 - policy_arn = aws_iam_policy.main[0].arn - role = aws_iam_role.main[0].name -} - -resource "aws_iam_role_policy_attachment" "extras" { - for_each = toset(var.fleet_config.extra_iam_policies) - policy_arn = each.value - role = aws_iam_role.main[0].name -} - -resource "aws_iam_role_policy_attachment" "execution_extras" { - for_each = toset(var.fleet_config.extra_execution_iam_policies) - policy_arn = each.value - role = aws_iam_role.execution.name -} - -resource "aws_iam_policy" "execution" { - name = var.fleet_config.iam.execution.policy_name - description = "IAM policy that Fleet application uses to define access to AWS resources" - policy = data.aws_iam_policy_document.fleet-execution.json -} - -resource "aws_iam_role_policy_attachment" "execution" { - policy_arn = aws_iam_policy.execution.arn - role = aws_iam_role.execution.name -} - -resource "aws_iam_role" "run_cloudwatch" { - name_prefix = "${var.customer_prefix}-cloudwatch-run" - assume_role_policy = data.aws_iam_policy_document.assume_events.json -} - -resource "aws_iam_policy" "run_cloudwatch" { - name_prefix = "${var.customer_prefix}-cloudwatch-run" - policy = data.aws_iam_policy_document.cloudwatch_task.json -} -resource "aws_iam_role_policy_attachment" "run_cloudwatch" { - role = aws_iam_role.run_cloudwatch.name - policy_arn = aws_iam_policy.run_cloudwatch.arn -} - -resource "aws_iam_role_policy_attachment" "ecs_role_attachment" { - role = aws_iam_role.execution.name - policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceRole" -} - -resource "aws_iam_role_policy_attachment" "ecs_task" { - policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceEventsRole" - role = aws_iam_role.execution.name -} - -resource "aws_iam_role" "execution" { - name = var.fleet_config.iam.execution.name - description = "The execution role for Fleet in ECS" - assume_role_policy = data.aws_iam_policy_document.assume_events.json -} \ No newline at end of file diff --git a/terraform/addons/vuln-processing/main.tf b/terraform/addons/vuln-processing/main.tf deleted file mode 100644 index 9a97e157db6c..000000000000 --- a/terraform/addons/vuln-processing/main.tf +++ /dev/null @@ -1,181 +0,0 @@ -locals { - environment = [for k, v in var.fleet_config.extra_environment_variables : { - name = k - value = v - }] - secrets = [for k, v in var.fleet_config.extra_secrets : { - name = k - valueFrom = v - }] -} - -data "aws_region" "current" {} - -resource "aws_cloudwatch_log_group" "main" { #tfsec:ignore:aws-cloudwatch-log-group-customer-key:exp:2022-07-01 - count = var.fleet_config.awslogs.create == true ? 1 : 0 - name = var.fleet_config.awslogs.name - retention_in_days = var.fleet_config.awslogs.retention -} - -resource "aws_ecs_task_definition" "vuln-data-stream" { - family = var.fleet_config.family - cpu = var.fleet_config.vuln_data_stream_cpu - memory = var.fleet_config.vuln_data_stream_mem - execution_role_arn = aws_iam_role.execution.arn - task_role_arn = aws_iam_role.main.arn - network_mode = "awsvpc" - requires_compatibilities = ["FARGATE"] - - container_definitions = jsonencode([ - { - name = "fleet-vuln-provisioner" - image = var.fleet_config.image - essential = true - user = "root" - command = ["fleetctl", "vulnerability-data-stream", "--dir=${var.fleet_config.vuln_database_path}"] - networkMode = "awsvpc" - mountPoints = [ - { - sourceVolume = "efs-mount" - containerPath = var.fleet_config.vuln_database_path - readOnly = false - } - ], - logConfiguration = { - logDriver = "awslogs" - options = { - awslogs-group = var.fleet_config.awslogs.create == true ? aws_cloudwatch_log_group.main[0].name : var.fleet_config.awslogs.name - awslogs-region = var.fleet_config.awslogs.create == true ? data.aws_region.current.name : var.fleet_config.awslogs.region - awslogs-stream-prefix = "${var.fleet_config.awslogs.prefix}-data-stream" - } - } - } - ]) - - volume { - name = "efs-mount" - efs_volume_configuration { - file_system_id = aws_efs_file_system.vuln.id - root_directory = var.efs_root_directory - } - } -} - - -resource "aws_ecs_task_definition" "vuln-processing" { - family = var.fleet_config.family - cpu = var.fleet_config.vuln_processing_cpu - memory = var.fleet_config.vuln_processing_mem - execution_role_arn = aws_iam_role.execution.arn - task_role_arn = aws_iam_role.main.arn - network_mode = "awsvpc" - requires_compatibilities = ["FARGATE"] - - container_definitions = jsonencode([ - { - name = "fleet-vuln-processing" - image = var.fleet_config.image - essential = true - command = ["fleet", "vuln_processing"] - user = "root" - networkMode = "awsvpc" - mountPoints = [ - { - sourceVolume = "efs-mount" - containerPath = var.fleet_config.vuln_database_path - readOnly = false - } - ], - secrets = concat( - [ - { - name = "FLEET_MYSQL_PASSWORD" - valueFrom = var.fleet_config.database.password_secret_arn - } - ], local.secrets), - environment = concat( - [ - { - name = "FLEET_MYSQL_USERNAME" - value = var.fleet_config.database.user - }, - { - name = "FLEET_MYSQL_DATABASE" - value = var.fleet_config.database.database - }, - { - name = "FLEET_MYSQL_ADDRESS" - value = var.fleet_config.database.address - }, - { - name = "FLEET_VULNERABILITIES_DISABLE_DATA_SYNC" - value = "true" - }, - { - name = "FLEET_VULNERABILITIES_DATABASES_PATH" - value = var.fleet_config.vuln_database_path - } - ], local.environment), - logConfiguration = { - logDriver = "awslogs" - options = { - awslogs-group = var.fleet_config.awslogs.create == true ? aws_cloudwatch_log_group.main[0].name : var.fleet_config.awslogs.name - awslogs-region = var.fleet_config.awslogs.create == true ? data.aws_region.current.name : var.fleet_config.awslogs.region - awslogs-stream-prefix = "${var.fleet_config.awslogs.prefix}-procssing" - } - } - } - ]) - - volume { - name = "efs-mount" - efs_volume_configuration { - file_system_id = aws_efs_file_system.vuln.id - root_directory = var.efs_root_directory - } - } -} - -resource "aws_cloudwatch_event_rule" "vuln_processing" { - name_prefix = "${var.customer_prefix}-vuln-processing" - schedule_expression = var.fleet_config.vuln_processing_schedule_expression -} - -resource "aws_cloudwatch_event_target" "vuln_processing" { - arn = var.ecs_cluster - rule = aws_cloudwatch_event_rule.vuln_processing.name - role_arn = aws_iam_role.run_cloudwatch.arn - ecs_target { - task_definition_arn = aws_ecs_task_definition.vuln-processing.arn - task_count = 1 - launch_type = "FARGATE" - - network_configuration { - assign_public_ip = false - subnets = var.fleet_config.networking.subnets - security_groups = var.fleet_config.networking.security_groups - } - } -} - -resource "aws_cloudwatch_event_rule" "vuln_data_stream" { - name_prefix = "${var.customer_prefix}-vuln-data-stream" - schedule_expression = var.fleet_config.vuln_data_stream_schedule_expression -} - -resource "aws_cloudwatch_event_target" "vuln_data_stream" { - arn = var.ecs_cluster - rule = aws_cloudwatch_event_rule.vuln_data_stream.name - role_arn = aws_iam_role.run_cloudwatch.arn - ecs_target { - task_definition_arn = aws_ecs_task_definition.vuln-data-stream.arn - task_count = 1 - launch_type = "FARGATE" - network_configuration { - assign_public_ip = false - subnets = var.fleet_config.networking.subnets - security_groups = var.fleet_config.networking.security_groups - } - } -} - diff --git a/terraform/addons/vuln-processing/outputs.tf b/terraform/addons/vuln-processing/outputs.tf deleted file mode 100644 index 2c1c7964b8dd..000000000000 --- a/terraform/addons/vuln-processing/outputs.tf +++ /dev/null @@ -1,9 +0,0 @@ -output "fleet_extra_environment_variables" { - value = { - FLEET_VULNERABILITIES_DISABLE_SCHEDULE = "true" - } -} - -output "enable_dns_hostnames" { - value = true -} \ No newline at end of file diff --git a/terraform/addons/vuln-processing/variables.tf b/terraform/addons/vuln-processing/variables.tf deleted file mode 100644 index 4df0e007b047..000000000000 --- a/terraform/addons/vuln-processing/variables.tf +++ /dev/null @@ -1,128 +0,0 @@ -variable "customer_prefix" { - type = string - description = "customer prefix to use to namespace all resources" - default = "fleet" -} - -variable "ecs_cluster" { - type = string - description = "The ARN of the ECS cluster to use" - nullable = false -} - -variable "vpc_id" { - type = string - default = null -} - -variable "fleet_config" { - type = object({ - vuln_processing_schedule_expression = optional(string, "rate(1 hour)") - vuln_data_stream_schedule_expression = optional(string, "rate(24 hours)") - vuln_database_path = optional(string, "/home/fleet/vuln_data") - vuln_processing_mem = optional(number, 4096) - vuln_processing_cpu = optional(number, 2048) - vuln_data_stream_mem = optional(number, 1024) - vuln_data_stream_cpu = optional(number, 512) - image = optional(string, "fleetdm/fleet:v4.63.0") - family = optional(string, "fleet-vuln-processing") - sidecars = optional(list(any), []) - extra_environment_variables = optional(map(string), {}) - extra_iam_policies = optional(list(string), []) - extra_execution_iam_policies = optional(list(string), []) - extra_secrets = optional(map(string), {}) - iam_role_arn = optional(string, null) - database = object({ - password_secret_arn = string - user = string - database = string - address = string - rr_address = optional(string, null) - }) - awslogs = optional(object({ - name = optional(string, null) - region = optional(string, null) - create = optional(bool, true) - prefix = optional(string, "fleet-vuln") - retention = optional(number, 5) - }), { - name = null - region = null - prefix = "fleet" - retention = 5 - }) - networking = object({ - subnets = list(string) - security_groups = optional(list(string), null) - }) - iam = optional(object({ - role = optional(object({ - name = optional(string, "fleet-vuln-processing-role") - policy_name = optional(string, "fleet-vuln-processing-iam-policy") - }), { - name = "fleet-vuln-processing-role" - policy_name = "fleet-vuln-processing-iam-policy" - }) - execution = optional(object({ - name = optional(string, "fleet-vuln-processing-execution-role") - policy_name = optional(string, "fleet-vuln-processing-execution-role") - }), { - name = "fleet-vuln-processing-execution-role" - policy_name = "fleet-vuln-processing-iam-policy-execution" - }) - }), { - name = "fleet-vuln-processing-execution-role" - }) - }) - default = { - vuln_processing_schedule_expression = "rate(1 hour)" - vuln_data_stream_schedule_expression = "rate(24 hours)" - vuln_database_path = "/home/fleet/vuln_data" - vuln_processing_mem = 4096 - vuln_processing_cpu = 2048 - vuln_data_stream_mem = 1024 - vuln_data_stream_cpu = 512 - image = "fleetdm/fleet:v4.63.0" - family = "fleet-vuln-processing" - sidecars = [] - extra_environment_variables = {} - extra_iam_policies = [] - extra_execution_iam_policies = [] - extra_secrets = {} - iam_role_arn = null - database = { - password_secret_arn = null - user = null - database = null - address = null - rr_address = null - } - awslogs = { - name = null - region = null - create = true - prefix = "fleet-vuln" - retention = 5 - } - networking = { - subnets = null - security_groups = null - } - iam = { - role = { - name = "fleet-vuln-processing-role" - policy_name = "fleet-vuln-processing-iam-policy" - } - execution = { - name = "fleet-vuln-processing-execution-role" - policy_name = "fleet-vuln-processing-iam-policy-execution" - } - } - } - description = "The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified." - nullable = false -} - -variable "efs_root_directory" { - default = "/" -} diff --git a/terraform/addons/waf-alb/.header.md b/terraform/addons/waf-alb/.header.md deleted file mode 100644 index 4dfec56e9a78..000000000000 --- a/terraform/addons/waf-alb/.header.md +++ /dev/null @@ -1,2 +0,0 @@ -# WAF for ALB addon -This addon creates and manages WAF attached to an ALB diff --git a/terraform/addons/waf-alb/.terraform-docs.yml b/terraform/addons/waf-alb/.terraform-docs.yml deleted file mode 100644 index 1d139ddb401d..000000000000 --- a/terraform/addons/waf-alb/.terraform-docs.yml +++ /dev/null @@ -1 +0,0 @@ -header-from: .header.md diff --git a/terraform/addons/waf-alb/README.md b/terraform/addons/waf-alb/README.md deleted file mode 100644 index 61a8c00f74fb..000000000000 --- a/terraform/addons/waf-alb/README.md +++ /dev/null @@ -1,38 +0,0 @@ -# WAF for ALB addon -This addon creates and manages WAF attached to an ALB - -## Requirements - -No requirements. - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | n/a | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [aws_wafv2_ip_set.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_ip_set) | resource | -| [aws_wafv2_rule_group.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_rule_group) | resource | -| [aws_wafv2_web_acl.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl) | resource | -| [aws_wafv2_web_acl_association.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl_association) | resource | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [blocked\_addresses](#input\_blocked\_addresses) | n/a | `list(string)` | `[]` | no | -| [blocked\_countries](#input\_blocked\_countries) | n/a | `list(string)` | 
[
  "BI",
  "BY",
  "CD",
  "CF",
  "CU",
  "IQ",
  "IR",
  "LB",
  "LY",
  "SD",
  "SO",
  "SS",
  "SY",
  "VE",
  "ZW",
  "RU"
]
| no | -| [lb\_arn](#input\_lb\_arn) | n/a | `any` | n/a | yes | -| [name](#input\_name) | n/a | `any` | n/a | yes | - -## Outputs - -No outputs. diff --git a/terraform/addons/waf-alb/main.tf b/terraform/addons/waf-alb/main.tf deleted file mode 100644 index a62daf3e1b2c..000000000000 --- a/terraform/addons/waf-alb/main.tf +++ /dev/null @@ -1,157 +0,0 @@ -locals { - default_action = var.waf_type == "blocklist" ? "block" : "allow" -} - -resource "aws_wafv2_rule_group" "blocked" { - count = var.waf_type == "blocklist" ? 1 : 0 - name = var.name - scope = "REGIONAL" - capacity = 2 - - rule { - name = "countries" - priority = 1 - - action { - block {} - } - - statement { - geo_match_statement { - country_codes = var.blocked_countries - } - } - - visibility_config { - cloudwatch_metrics_enabled = false - metric_name = var.name - sampled_requests_enabled = false - } - } - - rule { - name = "specific" - priority = 2 - - action { - block {} - } - - statement { - ip_set_reference_statement { - arn = aws_wafv2_ip_set.blocked[0].arn - } - } - - visibility_config { - cloudwatch_metrics_enabled = false - metric_name = var.name - sampled_requests_enabled = false - } - } - - visibility_config { - cloudwatch_metrics_enabled = false - metric_name = var.name - sampled_requests_enabled = false - } -} - -resource "aws_wafv2_ip_set" "blocked" { - count = var.waf_type == "blocklist" ? 1 : 0 - name = var.name - scope = "REGIONAL" - ip_address_version = "IPV4" - addresses = var.blocked_addresses -} - -resource "aws_wafv2_rule_group" "allowed" { - count = var.waf_type == "allowlist" ? 1 : 0 - name = var.name - scope = "REGIONAL" - capacity = 2 - - rule { - name = "specific" - priority = 1 - - action { - allow {} - } - - statement { - ip_set_reference_statement { - arn = aws_wafv2_ip_set.allowed[0].arn - } - } - - visibility_config { - cloudwatch_metrics_enabled = false - metric_name = var.name - sampled_requests_enabled = false - } - } - - visibility_config { - cloudwatch_metrics_enabled = false - metric_name = var.name - sampled_requests_enabled = false - } -} - -resource "aws_wafv2_web_acl" "main" { - name = var.name - scope = "REGIONAL" - - default_action { - dynamic "block" { - for_each = var.waf_type == "allowlist" ? [true] : [] - content {} - } - dynamic "allow" { - for_each = var.waf_type == "blocklist" ? [true] : [] - content {} - } - } - - rule { - name = "rule-1" - priority = 1 - - override_action { - none {} - } - - statement { - rule_group_reference_statement { - arn = var.waf_type == "blocklist" ? aws_wafv2_rule_group.blocked[0].arn : aws_wafv2_rule_group.allowed[0].arn - } - } - - visibility_config { - cloudwatch_metrics_enabled = false - metric_name = var.name - sampled_requests_enabled = false - } - } - - visibility_config { - cloudwatch_metrics_enabled = false - metric_name = var.name - sampled_requests_enabled = false - } -} - -resource "aws_wafv2_ip_set" "allowed" { - count = var.waf_type == "allowlist" ? 1 : 0 - name = var.name - scope = "REGIONAL" - ip_address_version = "IPV4" - addresses = var.allowed_addresses -} - - -resource "aws_wafv2_web_acl_association" "main" { - resource_arn = var.lb_arn - web_acl_arn = aws_wafv2_web_acl.main.arn -} diff --git a/terraform/addons/waf-alb/outputs.tf b/terraform/addons/waf-alb/outputs.tf deleted file mode 100644 index 8b137891791f..000000000000 --- a/terraform/addons/waf-alb/outputs.tf +++ /dev/null @@ -1 +0,0 @@ - diff --git a/terraform/addons/waf-alb/variables.tf b/terraform/addons/waf-alb/variables.tf deleted file mode 100644 index 2c16acc653c1..000000000000 --- a/terraform/addons/waf-alb/variables.tf +++ /dev/null @@ -1,23 +0,0 @@ -variable "name" {} - -variable "lb_arn" {} - -variable "waf_type" { - type = string - default = "blocklist" -} - -variable "blocked_countries" { - type = list(string) - default = ["BI", "BY", "CD", "CF", "CU", "IQ", "IR", "LB", "LY", "SD", "SO", "SS", "SY", "VE", "ZW", "RU"] -} - -variable "blocked_addresses" { - type = list(string) - default = [] -} - -variable "allowed_addresses" { - type = list(string) - default = [] -} diff --git a/terraform/addons/xrays-sidecar/.header.md b/terraform/addons/xrays-sidecar/.header.md deleted file mode 100644 index de177fcad4f6..000000000000 --- a/terraform/addons/xrays-sidecar/.header.md +++ /dev/null @@ -1,2 +0,0 @@ -# AWS Xrays ECS Sidecar -This addon provides a sidecar for AWS Xrays Opentelemetry to allow Fleet to send traces to AWS Xrays. diff --git a/terraform/addons/xrays-sidecar/.terraform-docs.yml b/terraform/addons/xrays-sidecar/.terraform-docs.yml deleted file mode 100644 index 1d139ddb401d..000000000000 --- a/terraform/addons/xrays-sidecar/.terraform-docs.yml +++ /dev/null @@ -1 +0,0 @@ -header-from: .header.md diff --git a/terraform/addons/xrays-sidecar/README.md b/terraform/addons/xrays-sidecar/README.md deleted file mode 100644 index 8f81f3c19713..000000000000 --- a/terraform/addons/xrays-sidecar/README.md +++ /dev/null @@ -1,36 +0,0 @@ -# AWS Xrays ECS Sidecar -This addon provides a sidecar for AWS Xrays Opentelemetry to allow Fleet to send traces to AWS Xrays. - -## Requirements - -No requirements. - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | n/a | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [aws_iam_policy.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | -| [aws_iam_policy_document.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | - -## Inputs - -No inputs. - -## Outputs - -| Name | Description | -|------|-------------| -| [fleet\_extra\_environment\_variables](#output\_fleet\_extra\_environment\_variables) | n/a | -| [fleet\_extra\_iam\_policies](#output\_fleet\_extra\_iam\_policies) | n/a | -| [fleet\_sidecars](#output\_fleet\_sidecars) | n/a | diff --git a/terraform/addons/xrays-sidecar/main.tf b/terraform/addons/xrays-sidecar/main.tf deleted file mode 100644 index 001700b0a362..000000000000 --- a/terraform/addons/xrays-sidecar/main.tf +++ /dev/null @@ -1,35 +0,0 @@ -data "aws_region" "current" {} - -data "aws_iam_policy_document" "main" { - statement { - actions = [ - "xray:PutTraceSegments", - "xray:PutTelemetryRecords", - "xray:GetSamplingRules", - "xray:GetSamplingTargets", - "xray:GetSamplingStatisticSummaries", - "logs:PutLogEvents", - "logs:CreateLogStream", - ] - resources = ["*"] - } -} - -resource "aws_iam_policy" "main" { - policy = data.aws_iam_policy_document.main.json -} - -data "aws_iam_policy_document" "execution" { - statement { - actions = [ - "logs:CreateLogStream", - "logs:PutLogEvents", - "logs:CreateLogGroup", - ] - resources = ["*"] - } -} - -resource "aws_iam_policy" "execution" { - policy = data.aws_iam_policy_document.execution.json -} diff --git a/terraform/addons/xrays-sidecar/outputs.tf b/terraform/addons/xrays-sidecar/outputs.tf deleted file mode 100644 index 46339d3a2715..000000000000 --- a/terraform/addons/xrays-sidecar/outputs.tf +++ /dev/null @@ -1,38 +0,0 @@ -output "fleet_extra_iam_policies" { - value = [aws_iam_policy.main.arn] -} - -output "fleet_extra_execution_iam_policies" { - value = [aws_iam_policy.execution.arn] -} - -output "fleet_sidecars" { - value = [ - { - "name" : "aws-otel-collector", - "image" : "public.ecr.aws/aws-observability/aws-otel-collector:v0.26.1", - "essential" : true, - "command" : [ - "--config=/etc/ecs/ecs-default-config.yaml" - ], - "logConfiguration" : { - "logDriver" : "awslogs", - "options" : { - "awslogs-create-group" : "True", - "awslogs-group" : "/ecs/ecs-aws-otel-sidecar-collector", - "awslogs-region" : data.aws_region.current.name, - "awslogs-stream-prefix" : "ecs" - } - } - } - ] -} - -output "fleet_extra_environment_variables" { - value = { - FLEET_LOGGING_TRACING_ENABLED = "true" - FLEET_LOGGING_TRACING_TYPE = "opentelemetry" - OTEL_SERVICE_NAME = "fleet" - OTEL_EXPORTER_OTLP_ENDPOINT = "http://localhost:4317" - } -} diff --git a/terraform/addons/xrays-sidecar/variables.tf b/terraform/addons/xrays-sidecar/variables.tf deleted file mode 100644 index 8b137891791f..000000000000 --- a/terraform/addons/xrays-sidecar/variables.tf +++ /dev/null @@ -1 +0,0 @@ - diff --git a/terraform/byo-vpc/.terraform.lock.hcl b/terraform/byo-vpc/.terraform.lock.hcl deleted file mode 100644 index 6629117d4f24..000000000000 --- a/terraform/byo-vpc/.terraform.lock.hcl +++ /dev/null @@ -1,47 +0,0 @@ -# This file is maintained automatically by "terraform init". -# Manual edits may be lost in future updates. - -provider "registry.terraform.io/hashicorp/aws" { - version = "5.23.1" - constraints = ">= 2.67.0, >= 3.0.0, >= 4.6.0, >= 4.18.0, >= 4.27.0, >= 4.30.0" - hashes = [ - "h1:keD9rGwuFbn70D1npMx486xFsSP/TtyNa6E0AgVJY1U=", - "h1:s23thJVPJHUdS7ESZHoeMkxNcTeaqWvg2usv8ylFVL4=", - "zh:024a188ad3c979a9ec0d7d898aaa90a3867a8839edc8d3543ea6155e6e010064", - "zh:05b73a04c58534a7527718ef55040577d5c573ea704e16a813e7d1b18a7f4c26", - "zh:13932cdee2fa90f40ebaa783f033752864eb6899129e055511359f8d1ada3710", - "zh:3500f5febc7878b4426ef89a16c0096eefd4dd0c5b0d9ba00f9ed54387df5d09", - "zh:394a48dea7dfb0ae40e506ccdeb5387829dbb8ab00fb64f41c347a1de092aa00", - "zh:51a57f258b3bce2c167b39b6ecf486f72f523da05d4c92adc6b697abe1c5ff1f", - "zh:7290488a96d8d10119b431eb08a37407c0812283042a21b69bcc2454eabc08ad", - "zh:7545389dbbba624c0ffa72fa376b359b27f484aba02139d37ee5323b589e0939", - "zh:92266ac6070809e0c874511ae93097c8b1eddce4c0213e487c5439e89b6ad64d", - "zh:9b12af85486a96aedd8d7984b0ff811a4b42e3d88dad1a3fb4c0b580d04fa425", - "zh:9c3841bd650d6ba471c7159bcdfa35200e5e49c2ea11032c481a33cf7875879d", - "zh:bd103c46a16e7f9357e08d6427c316ccc56d203452130eed8e36ede3afa3322c", - "zh:cab0a16e320c6ca285a3a51f40c8f46dbaa0712856594819b415b4d8b3e63910", - "zh:e8adedcda4d6ff47dcae9c9bb884da26ca448fb6f7436be95ad6a341e4d8094a", - "zh:fc23701a3723f50878f440dcdf8768ea96d60a0d7c351aa6dfb912ad832c8384", - ] -} - -provider "registry.terraform.io/hashicorp/random" { - version = "3.5.1" - constraints = ">= 2.2.0" - hashes = [ - "h1:IL9mSatmwov+e0+++YX2V6uel+dV6bn+fC/cnGDK3Ck=", - "h1:VSnd9ZIPyfKHOObuQCaKfnjIHRtR7qTw19Rz8tJxm+k=", - "zh:04e3fbd610cb52c1017d282531364b9c53ef72b6bc533acb2a90671957324a64", - "zh:119197103301ebaf7efb91df8f0b6e0dd31e6ff943d231af35ee1831c599188d", - "zh:4d2b219d09abf3b1bb4df93d399ed156cadd61f44ad3baf5cf2954df2fba0831", - "zh:6130bdde527587bbe2dcaa7150363e96dbc5250ea20154176d82bc69df5d4ce3", - "zh:6cc326cd4000f724d3086ee05587e7710f032f94fc9af35e96a386a1c6f2214f", - "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3", - "zh:b6d88e1d28cf2dfa24e9fdcc3efc77adcdc1c3c3b5c7ce503a423efbdd6de57b", - "zh:ba74c592622ecbcef9dc2a4d81ed321c4e44cddf7da799faa324da9bf52a22b2", - "zh:c7c5cde98fe4ef1143bd1b3ec5dc04baf0d4cc3ca2c5c7d40d17c0e9b2076865", - "zh:dac4bad52c940cd0dfc27893507c1e92393846b024c5a9db159a93c534a3da03", - "zh:de8febe2a2acd9ac454b844a4106ed295ae9520ef54dc8ed2faf29f12716b602", - "zh:eab0d0495e7e711cca367f7d4df6e322e6c562fc52151ec931176115b83ed014", - ] -} diff --git a/terraform/byo-vpc/README.md b/terraform/byo-vpc/README.md deleted file mode 100644 index c40128a9da0e..000000000000 --- a/terraform/byo-vpc/README.md +++ /dev/null @@ -1,49 +0,0 @@ -## Requirements - -No requirements. - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | 5.23.1 | -| [random](#provider\_random) | 3.5.1 | - -## Modules - -| Name | Source | Version | -|------|--------|---------| -| [byo-db](#module\_byo-db) | ./byo-db | n/a | -| [rds](#module\_rds) | terraform-aws-modules/rds-aurora/aws | 7.6.0 | -| [redis](#module\_redis) | cloudposse/elasticache-redis/aws | 0.53.0 | -| [secrets-manager-1](#module\_secrets-manager-1) | lgallard/secrets-manager/aws | 0.6.1 | - -## Resources - -| Name | Type | -|------|------| -| [aws_db_parameter_group.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/db_parameter_group) | resource | -| [aws_rds_cluster_parameter_group.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rds_cluster_parameter_group) | resource | -| [random_password.rds](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource | -| [aws_subnet.redis](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/subnet) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [alb\_config](#input\_alb\_config) | n/a | 
object({
    name                 = optional(string, "fleet")
    subnets              = list(string)
    security_groups      = optional(list(string), [])
    access_logs          = optional(map(string), {})
    certificate_arn      = string
    allowed_cidrs        = optional(list(string), ["0.0.0.0/0"])
    allowed_ipv6_cidrs   = optional(list(string), ["::/0"])
    egress_cidrs         = optional(list(string), ["0.0.0.0/0"])
    egress_ipv6_cidrs    = optional(list(string), ["::/0"])
    extra_target_groups  = optional(any, [])
    https_listener_rules = optional(any, [])
    tls_policy           = optional(string, "ELBSecurityPolicy-TLS-1-2-2017-01")
    idle_timeout         = optional(number, 905)
  })
| n/a | yes | -| [ecs\_cluster](#input\_ecs\_cluster) | The config for the terraform-aws-modules/ecs/aws module | 
object({
    autoscaling_capacity_providers = optional(any, {})
    cluster_configuration = optional(any, {
      execute_command_configuration = {
        logging = "OVERRIDE"
        log_configuration = {
          cloud_watch_log_group_name = "/aws/ecs/aws-ec2"
        }
      }
    })
    cluster_name = optional(string, "fleet")
    cluster_settings = optional(map(string), {
      "name" : "containerInsights",
      "value" : "enabled",
    })
    create                                = optional(bool, true)
    default_capacity_provider_use_fargate = optional(bool, true)
    fargate_capacity_providers = optional(any, {
      FARGATE = {
        default_capacity_provider_strategy = {
          weight = 100
        }
      }
      FARGATE_SPOT = {
        default_capacity_provider_strategy = {
          weight = 0
        }
      }
    })
    tags = optional(map(string))
  })
| 
{
  "autoscaling_capacity_providers": {},
  "cluster_configuration": {
    "execute_command_configuration": {
      "log_configuration": {
        "cloud_watch_log_group_name": "/aws/ecs/aws-ec2"
      },
      "logging": "OVERRIDE"
    }
  },
  "cluster_name": "fleet",
  "cluster_settings": {
    "name": "containerInsights",
    "value": "enabled"
  },
  "create": true,
  "default_capacity_provider_use_fargate": true,
  "fargate_capacity_providers": {
    "FARGATE": {
      "default_capacity_provider_strategy": {
        "weight": 100
      }
    },
    "FARGATE_SPOT": {
      "default_capacity_provider_strategy": {
        "weight": 0
      }
    }
  },
  "tags": {}
}
| no | -| [fleet\_config](#input\_fleet\_config) | The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified. | 
object({
    task_mem                     = optional(number, null)
    task_cpu                     = optional(number, null)
    mem                          = optional(number, 4096)
    cpu                          = optional(number, 512)
    pid_mode                     = optional(string, null)
    image                        = optional(string, "fleetdm/fleet:v4.54.1")
    family                       = optional(string, "fleet")
    sidecars                     = optional(list(any), [])
    depends_on                   = optional(list(any), [])
    mount_points                 = optional(list(any), [])
    volumes                      = optional(list(any), [])
    extra_environment_variables  = optional(map(string), {})
    extra_iam_policies           = optional(list(string), [])
    extra_execution_iam_policies = optional(list(string), [])
    extra_secrets                = optional(map(string), {})
    security_group_name          = optional(string, "fleet")
    iam_role_arn                 = optional(string, null)
    repository_credentials       = optional(string, "")
    private_key_secret_name      = optional(string, "fleet-server-private-key")
    service = optional(object({
      name = optional(string, "fleet")
      }), {
      name = "fleet"
    })
    database = optional(object({
      password_secret_arn = string
      user                = string
      database            = string
      address             = string
      rr_address          = optional(string, null)
      }), {
      password_secret_arn = null
      user                = null
      database            = null
      address             = null
      rr_address          = null
    })
    redis = optional(object({
      address = string
      use_tls = optional(bool, true)
      }), {
      address = null
      use_tls = true
    })
    awslogs = optional(object({
      name      = optional(string, null)
      region    = optional(string, null)
      create    = optional(bool, true)
      prefix    = optional(string, "fleet")
      retention = optional(number, 5)
      }), {
      name      = null
      region    = null
      prefix    = "fleet"
      retention = 5
    })
    loadbalancer = optional(object({
      arn = string
      }), {
      arn = null
    })
    extra_load_balancers = optional(list(any), [])
    networking = optional(object({
      subnets         = optional(list(string), null)
      security_groups = optional(list(string), null)
      ingress_sources = optional(object({
        cidr_blocks      = optional(list(string), [])
        ipv6_cidr_blocks = optional(list(string), [])
        security_groups  = optional(list(string), [])
        prefix_list_ids  = optional(list(string), [])
        }), {
        cidr_blocks      = []
        ipv6_cidr_blocks = []
        security_groups  = []
        prefix_list_ids  = []
      })
      }), {
      subnets         = null
      security_groups = null
      ingress_sources = {
        cidr_blocks      = []
        ipv6_cidr_blocks = []
        security_groups  = []
        prefix_list_ids  = []
      }
    })
    autoscaling = optional(object({
      max_capacity                 = optional(number, 5)
      min_capacity                 = optional(number, 1)
      memory_tracking_target_value = optional(number, 80)
      cpu_tracking_target_value    = optional(number, 80)
      }), {
      max_capacity                 = 5
      min_capacity                 = 1
      memory_tracking_target_value = 80
      cpu_tracking_target_value    = 80
    })
    iam = optional(object({
      role = optional(object({
        name        = optional(string, "fleet-role")
        policy_name = optional(string, "fleet-iam-policy")
        }), {
        name        = "fleet-role"
        policy_name = "fleet-iam-policy"
      })
      execution = optional(object({
        name        = optional(string, "fleet-execution-role")
        policy_name = optional(string, "fleet-execution-role")
        }), {
        name        = "fleet-execution-role"
        policy_name = "fleet-iam-policy-execution"
      })
      }), {
      name = "fleetdm-execution-role"
    })
    software_installers = optional(object({
      create_bucket    = optional(bool, true)
      bucket_name      = optional(string, null)
      bucket_prefix    = optional(string, "fleet-software-installers-")
      s3_object_prefix = optional(string, "")
      }), {
      create_bucket    = true
      bucket_name      = null
      bucket_prefix    = "fleet-software-installers-"
      s3_object_prefix = ""
    })
  })
| 
{
  "autoscaling": {
    "cpu_tracking_target_value": 80,
    "max_capacity": 5,
    "memory_tracking_target_value": 80,
    "min_capacity": 1
  },
  "awslogs": {
    "create": true,
    "name": null,
    "prefix": "fleet",
    "region": null,
    "retention": 5
  },
  "cpu": 256,
  "database": {
    "address": null,
    "database": null,
    "password_secret_arn": null,
    "rr_address": null,
    "user": null
  },
  "depends_on": [],
  "extra_environment_variables": {},
  "extra_execution_iam_policies": [],
  "extra_iam_policies": [],
  "extra_load_balancers": [],
  "extra_secrets": {},
  "family": "fleet",
  "iam": {
    "execution": {
      "name": "fleet-execution-role",
      "policy_name": "fleet-iam-policy-execution"
    },
    "role": {
      "name": "fleet-role",
      "policy_name": "fleet-iam-policy"
    }
  },
  "iam_role_arn": null,
  "image": "fleetdm/fleet:v4.54.1",
  "loadbalancer": {
    "arn": null
  },
  "mem": 512,
  "mount_points": [],
  "networking": {
    "ingress_sources": {
      "cidr_blocks": [],
      "ipv6_cidr_blocks": [],
      "prefix_list_ids": [],
      "security_groups": []
    },
    "security_groups": null,
    "subnets": null
  },
  "pid_mode": null,
  "private_key_secret_name": "fleet-server-private-key",
  "redis": {
    "address": null,
    "use_tls": true
  },
  "repository_credentials": "",
  "security_group_name": "fleet",
  "security_groups": null,
  "service": {
    "name": "fleet"
  },
  "sidecars": [],
  "software_installers": {
    "bucket_name": null,
    "bucket_prefix": "fleet-software-installers-",
    "create_bucket": true,
    "s3_object_prefix": ""
  },
  "task_cpu": null,
  "task_mem": null,
  "volumes": []
}
| no | -| [migration\_config](#input\_migration\_config) | The configuration object for Fleet's migration task. | 
object({
    mem = number
    cpu = number
  })
| 
{
  "cpu": 1024,
  "mem": 2048
}
| no | -| [rds\_config](#input\_rds\_config) | The config for the terraform-aws-modules/rds-aurora/aws module | 
object({
    name                            = optional(string, "fleet")
    engine_version                  = optional(string, "8.0.mysql_aurora.3.07.1")
    instance_class                  = optional(string, "db.t4g.large")
    subnets                         = optional(list(string), [])
    allowed_security_groups         = optional(list(string), [])
    allowed_cidr_blocks             = optional(list(string), [])
    apply_immediately               = optional(bool, true)
    monitoring_interval             = optional(number, 10)
    db_parameter_group_name         = optional(string)
    db_parameters                   = optional(map(string), {})
    db_cluster_parameter_group_name = optional(string)
    db_cluster_parameters           = optional(map(string), {})
    enabled_cloudwatch_logs_exports = optional(list(string), [])
    master_username                 = optional(string, "fleet")
    snapshot_identifier             = optional(string)
    cluster_tags                    = optional(map(string), {})
    preferred_maintenance_window    = optional(string, "thu:23:00-fri:00:00")
  })
| 
{
  "allowed_cidr_blocks": [],
  "allowed_security_groups": [],
  "apply_immediately": true,
  "cluster_tags": {},
  "db_cluster_parameter_group_name": null,
  "db_cluster_parameters": {},
  "db_parameter_group_name": null,
  "db_parameters": {},
  "enabled_cloudwatch_logs_exports": [],
  "engine_version": "8.0.mysql_aurora.3.07.1",
  "instance_class": "db.t4g.large",
  "master_username": "fleet",
  "monitoring_interval": 10,
  "name": "fleet",
  "preferred_maintenance_window": "thu:23:00-fri:00:00",
  "snapshot_identifier": null,
  "subnets": []
}
| no | -| [redis\_config](#input\_redis\_config) | n/a | 
object({
    name                          = optional(string, "fleet")
    replication_group_id          = optional(string)
    elasticache_subnet_group_name = optional(string, "")
    allowed_security_group_ids    = optional(list(string), [])
    subnets                       = list(string)
    allowed_cidrs                 = list(string)
    availability_zones            = optional(list(string), [])
    cluster_size                  = optional(number, 3)
    instance_type                 = optional(string, "cache.m5.large")
    apply_immediately             = optional(bool, true)
    automatic_failover_enabled    = optional(bool, false)
    engine_version                = optional(string, "6.x")
    family                        = optional(string, "redis6.x")
    at_rest_encryption_enabled    = optional(bool, true)
    transit_encryption_enabled    = optional(bool, true)
    parameter = optional(list(object({
      name  = string
      value = string
    })), [])
    log_delivery_configuration = optional(list(map(any)), [])
    tags                       = optional(map(string), {})
  })
| 
{
  "allowed_cidrs": null,
  "allowed_security_group_ids": [],
  "apply_immediately": true,
  "at_rest_encryption_enabled": true,
  "automatic_failover_enabled": false,
  "availability_zones": [],
  "cluster_size": 3,
  "elasticache_subnet_group_name": "",
  "engine_version": "6.x",
  "family": "redis6.x",
  "instance_type": "cache.m5.large",
  "log_delivery_configuration": [],
  "name": "fleet",
  "parameter": [],
  "replication_group_id": null,
  "subnets": null,
  "tags": {},
  "transit_encryption_enabled": true
}
| no | -| [vpc\_config](#input\_vpc\_config) | n/a | 
object({
    vpc_id = string
    networking = object({
      subnets = list(string)
    })
  })
| n/a | yes | - -## Outputs - -| Name | Description | -|------|-------------| -| [byo-db](#output\_byo-db) | n/a | -| [rds](#output\_rds) | n/a | -| [redis](#output\_redis) | n/a | -| [secrets](#output\_secrets) | n/a | diff --git a/terraform/byo-vpc/byo-db/README.md b/terraform/byo-vpc/byo-db/README.md deleted file mode 100644 index 09d2c4a024dc..000000000000 --- a/terraform/byo-vpc/byo-db/README.md +++ /dev/null @@ -1,41 +0,0 @@ -## Requirements - -No requirements. - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | 4.62.2 | - -## Modules - -| Name | Source | Version | -|------|--------|---------| -| [alb](#module\_alb) | terraform-aws-modules/alb/aws | 8.3.0 | -| [cluster](#module\_cluster) | terraform-aws-modules/ecs/aws | 4.1.2 | -| [ecs](#module\_ecs) | ./byo-ecs | n/a | - -## Resources - -| Name | Type | -|------|------| -| [aws_security_group.alb](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [alb\_config](#input\_alb\_config) | n/a | 
object({
    name                 = optional(string, "fleet")
    subnets              = list(string)
    security_groups      = optional(list(string), [])
    access_logs          = optional(map(string), {})
    certificate_arn      = string
    allowed_cidrs        = optional(list(string), ["0.0.0.0/0"])
    allowed_ipv6_cidrs   = optional(list(string), ["::/0"])
    egress_cidrs         = optional(list(string), ["0.0.0.0/0"])
    egress_ipv6_cidrs    = optional(list(string), ["::/0"])
    extra_target_groups  = optional(any, [])
    https_listener_rules = optional(any, [])
    tls_policy           = optional(string, "ELBSecurityPolicy-TLS-1-2-2017-01")
    idle_timeout         = optional(number, 905)
  })
| n/a | yes | -| [ecs\_cluster](#input\_ecs\_cluster) | The config for the terraform-aws-modules/ecs/aws module | 
object({
    autoscaling_capacity_providers = optional(any, {})
    cluster_configuration = optional(any, {
      execute_command_configuration = {
        logging = "OVERRIDE"
        log_configuration = {
          cloud_watch_log_group_name = "/aws/ecs/aws-ec2"
        }
      }
    })
    cluster_name = optional(string, "fleet")
    cluster_settings = optional(map(string), {
      "name" : "containerInsights",
      "value" : "enabled",
    })
    create                                = optional(bool, true)
    default_capacity_provider_use_fargate = optional(bool, true)
    fargate_capacity_providers = optional(any, {
      FARGATE = {
        default_capacity_provider_strategy = {
          weight = 100
        }
      }
      FARGATE_SPOT = {
        default_capacity_provider_strategy = {
          weight = 0
        }
      }
    })
    tags = optional(map(string))
  })
| 
{
  "autoscaling_capacity_providers": {},
  "cluster_configuration": {
    "execute_command_configuration": {
      "log_configuration": {
        "cloud_watch_log_group_name": "/aws/ecs/aws-ec2"
      },
      "logging": "OVERRIDE"
    }
  },
  "cluster_name": "fleet",
  "cluster_settings": {
    "name": "containerInsights",
    "value": "enabled"
  },
  "create": true,
  "default_capacity_provider_use_fargate": true,
  "fargate_capacity_providers": {
    "FARGATE": {
      "default_capacity_provider_strategy": {
        "weight": 100
      }
    },
    "FARGATE_SPOT": {
      "default_capacity_provider_strategy": {
        "weight": 0
      }
    }
  },
  "tags": {}
}
| no | -| [fleet\_config](#input\_fleet\_config) | The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified. | 
object({
    task_mem                     = optional(number, null)
    task_cpu                     = optional(number, null)
    mem                          = optional(number, 4096)
    cpu                          = optional(number, 512)
    pid_mode                     = optional(string, null)
    image                        = optional(string, "fleetdm/fleet:v4.54.1")
    family                       = optional(string, "fleet")
    sidecars                     = optional(list(any), [])
    depends_on                   = optional(list(any), [])
    mount_points                 = optional(list(any), [])
    volumes                      = optional(list(any), [])
    extra_environment_variables  = optional(map(string), {})
    extra_iam_policies           = optional(list(string), [])
    extra_execution_iam_policies = optional(list(string), [])
    extra_secrets                = optional(map(string), {})
    security_group_name          = optional(string, "fleet")
    iam_role_arn                 = optional(string, null)
    repository_credentials       = optional(string, "")
    private_key_secret_name      = optional(string, "fleet-server-private-key")
    service = optional(object({
      name = optional(string, "fleet")
      }), {
      name = "fleet"
    })
    database = optional(object({
      password_secret_arn = string
      user                = string
      database            = string
      address             = string
      rr_address          = optional(string, null)
      }), {
      password_secret_arn = null
      user                = null
      database            = null
      address             = null
      rr_address          = null
    })
    redis = optional(object({
      address = string
      use_tls = optional(bool, true)
      }), {
      address = null
      use_tls = true
    })
    awslogs = optional(object({
      name      = optional(string, null)
      region    = optional(string, null)
      create    = optional(bool, true)
      prefix    = optional(string, "fleet")
      retention = optional(number, 5)
      }), {
      name      = null
      region    = null
      prefix    = "fleet"
      retention = 5
    })
    loadbalancer = optional(object({
      arn = string
      }), {
      arn = null
    })
    extra_load_balancers = optional(list(any), [])
    networking = optional(object({
      subnets         = optional(list(string), null)
      security_groups = optional(list(string), null)
      ingress_sources = optional(object({
        cidr_blocks      = optional(list(string), [])
        ipv6_cidr_blocks = optional(list(string), [])
        security_groups  = optional(list(string), [])
        prefix_list_ids  = optional(list(string), [])
        }), {
        cidr_blocks      = []
        ipv6_cidr_blocks = []
        security_groups  = []
        prefix_list_ids  = []
      })
      }), {
      subnets         = null
      security_groups = null
      ingress_sources = {
        cidr_blocks      = []
        ipv6_cidr_blocks = []
        security_groups  = []
        prefix_list_ids  = []
      }
    })
    autoscaling = optional(object({
      max_capacity                 = optional(number, 5)
      min_capacity                 = optional(number, 1)
      memory_tracking_target_value = optional(number, 80)
      cpu_tracking_target_value    = optional(number, 80)
      }), {
      max_capacity                 = 5
      min_capacity                 = 1
      memory_tracking_target_value = 80
      cpu_tracking_target_value    = 80
    })
    iam = optional(object({
      role = optional(object({
        name        = optional(string, "fleet-role")
        policy_name = optional(string, "fleet-iam-policy")
        }), {
        name        = "fleet-role"
        policy_name = "fleet-iam-policy"
      })
      execution = optional(object({
        name        = optional(string, "fleet-execution-role")
        policy_name = optional(string, "fleet-execution-role")
        }), {
        name        = "fleet-execution-role"
        policy_name = "fleet-iam-policy-execution"
      })
      }), {
      name = "fleetdm-execution-role"
    })
    software_installers = optional(object({
      create_bucket    = optional(bool, true)
      bucket_name      = optional(string, null)
      bucket_prefix    = optional(string, "fleet-software-installers-")
      s3_object_prefix = optional(string, "")
      }), {
      create_bucket    = true
      bucket_name      = null
      bucket_prefix    = "fleet-software-installers-"
      s3_object_prefix = ""
    })
  })
| 
{
  "autoscaling": {
    "cpu_tracking_target_value": 80,
    "max_capacity": 5,
    "memory_tracking_target_value": 80,
    "min_capacity": 1
  },
  "awslogs": {
    "create": true,
    "name": null,
    "prefix": "fleet",
    "region": null,
    "retention": 5
  },
  "cpu": 256,
  "database": {
    "address": null,
    "database": null,
    "password_secret_arn": null,
    "rr_address": null,
    "user": null
  },
  "depends_on": [],
  "extra_environment_variables": {},
  "extra_execution_iam_policies": [],
  "extra_iam_policies": [],
  "extra_load_balancers": [],
  "extra_secrets": {},
  "family": "fleet",
  "iam": {
    "execution": {
      "name": "fleet-execution-role",
      "policy_name": "fleet-iam-policy-execution"
    },
    "role": {
      "name": "fleet-role",
      "policy_name": "fleet-iam-policy"
    }
  },
  "iam_role_arn": null,
  "image": "fleetdm/fleet:v4.54.1",
  "loadbalancer": {
    "arn": null
  },
  "mem": 512,
  "mount_points": [],
  "networking": {
    "ingress_sources": {
      "cidr_blocks": [],
      "ipv6_cidr_blocks": [],
      "prefix_list_ids": [],
      "security_groups": []
    },
    "security_groups": null,
    "subnets": null
  },
  "pid_mode": null,
  "private_key_secret_name": "fleet-server-private-key",
  "redis": {
    "address": null,
    "use_tls": true
  },
  "repository_credentials": "",
  "security_group_name": "fleet",
  "security_groups": null,
  "service": {
    "name": "fleet"
  },
  "sidecars": [],
  "software_installers": {
    "bucket_name": null,
    "bucket_prefix": "fleet-software-installers-",
    "create_bucket": true,
    "s3_object_prefix": ""
  },
  "task_cpu": null,
  "task_mem": null,
  "volumes": []
}
| no | -| [migration\_config](#input\_migration\_config) | The configuration object for Fleet's migration task. | 
object({
    mem = number
    cpu = number
  })
| 
{
  "cpu": 1024,
  "mem": 2048
}
| no | -| [vpc\_id](#input\_vpc\_id) | n/a | `string` | n/a | yes | - -## Outputs - -| Name | Description | -|------|-------------| -| [alb](#output\_alb) | n/a | -| [byo-ecs](#output\_byo-ecs) | n/a | -| [cluster](#output\_cluster) | n/a | diff --git a/terraform/byo-vpc/byo-db/byo-ecs/README.md b/terraform/byo-vpc/byo-db/byo-ecs/README.md deleted file mode 100644 index fc701fb07c9f..000000000000 --- a/terraform/byo-vpc/byo-db/byo-ecs/README.md +++ /dev/null @@ -1,72 +0,0 @@ -## Requirements - -No requirements. - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | 5.14.0 | -| [random](#provider\_random) | 3.6.2 | - -## Modules - -No modules. - -## Resources - -| Name | Type | -|------|------| -| [aws_appautoscaling_policy.ecs_policy_cpu](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/appautoscaling_policy) | resource | -| [aws_appautoscaling_policy.ecs_policy_memory](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/appautoscaling_policy) | resource | -| [aws_appautoscaling_target.ecs_target](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/appautoscaling_target) | resource | -| [aws_cloudwatch_log_group.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource | -| [aws_ecs_service.fleet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_service) | resource | -| [aws_ecs_task_definition.backend](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ecs_task_definition) | resource | -| [aws_iam_policy.execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | -| [aws_iam_policy.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | -| [aws_iam_policy.software_installers](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | -| [aws_iam_role.execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | -| [aws_iam_role.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | -| [aws_iam_role_policy_attachment.execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | -| [aws_iam_role_policy_attachment.execution_extras](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | -| [aws_iam_role_policy_attachment.extras](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | -| [aws_iam_role_policy_attachment.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | -| [aws_iam_role_policy_attachment.role_attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | -| [aws_iam_role_policy_attachment.software_installers](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | -| [aws_s3_bucket.software_installers](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource | -| [aws_s3_bucket_public_access_block.software_installers](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_public_access_block) | resource | -| [aws_s3_bucket_server_side_encryption_configuration.software_installers](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_server_side_encryption_configuration) | resource | -| [aws_secretsmanager_secret.fleet_server_private_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret) | resource | -| [aws_secretsmanager_secret_version.fleet_server_private_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/secretsmanager_secret_version) | resource | -| [aws_security_group.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource | -| [random_password.fleet_server_private_key](https://registry.terraform.io/providers/hashicorp/random/latest/docs/resources/password) | resource | -| [aws_iam_policy_document.assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.fleet](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.fleet-execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_iam_policy_document.software_installers](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | -| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source | - -## Inputs - -| Name | Description | Type | Default | Required | -|------|-------------|------|---------|:--------:| -| [ecs\_cluster](#input\_ecs\_cluster) | The name of the ECS cluster to use | `string` | n/a | yes | -| [fleet\_config](#input\_fleet\_config) | The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified. | 
object({
    task_mem                     = optional(number, null)
    task_cpu                     = optional(number, null)
    mem                          = optional(number, 4096)
    cpu                          = optional(number, 512)
    pid_mode                     = optional(string, null)
    image                        = optional(string, "fleetdm/fleet:v4.54.1")
    family                       = optional(string, "fleet")
    sidecars                     = optional(list(any), [])
    depends_on                   = optional(list(any), [])
    mount_points                 = optional(list(any), [])
    volumes                      = optional(list(any), [])
    extra_environment_variables  = optional(map(string), {})
    extra_iam_policies           = optional(list(string), [])
    extra_execution_iam_policies = optional(list(string), [])
    extra_secrets                = optional(map(string), {})
    security_group_name          = optional(string, "fleet")
    iam_role_arn                 = optional(string, null)
    repository_credentials       = optional(string, "")
    private_key_secret_name      = optional(string, "fleet-server-private-key")
    service = optional(object({
      name = optional(string, "fleet")
      }), {
      name = "fleet"
    })
    database = object({
      password_secret_arn = string
      user                = string
      database            = string
      address             = string
      rr_address          = optional(string, null)
    })
    redis = object({
      address = string
      use_tls = optional(bool, true)
    })
    awslogs = optional(object({
      name      = optional(string, null)
      region    = optional(string, null)
      create    = optional(bool, true)
      prefix    = optional(string, "fleet")
      retention = optional(number, 5)
      }), {
      name      = null
      region    = null
      prefix    = "fleet"
      retention = 5
    })
    loadbalancer = object({
      arn = string
    })
    extra_load_balancers = optional(list(any), [])
    networking = object({
      subnets         = optional(list(string), null)
      security_groups = optional(list(string), null)
      ingress_sources = object({
        cidr_blocks      = optional(list(string), [])
        ipv6_cidr_blocks = optional(list(string), [])
        security_groups  = optional(list(string), [])
        prefix_list_ids  = optional(list(string), [])
      })
    })
    autoscaling = optional(object({
      max_capacity                 = optional(number, 5)
      min_capacity                 = optional(number, 1)
      memory_tracking_target_value = optional(number, 80)
      cpu_tracking_target_value    = optional(number, 80)
      }), {
      max_capacity                 = 5
      min_capacity                 = 1
      memory_tracking_target_value = 80
      cpu_tracking_target_value    = 80
    })
    iam = optional(object({
      role = optional(object({
        name        = optional(string, "fleet-role")
        policy_name = optional(string, "fleet-iam-policy")
        }), {
        name        = "fleet-role"
        policy_name = "fleet-iam-policy"
      })
      execution = optional(object({
        name        = optional(string, "fleet-execution-role")
        policy_name = optional(string, "fleet-execution-role")
        }), {
        name        = "fleet-execution-role"
        policy_name = "fleet-iam-policy-execution"
      })
      }), {
      name = "fleetdm-execution-role"
    })
    software_installers = optional(object({
      create_bucket    = optional(bool, true)
      bucket_name      = optional(string, null)
      bucket_prefix    = optional(string, "fleet-software-installers-")
      s3_object_prefix = optional(string, "")
      }), {
      create_bucket    = true
      bucket_name      = null
      bucket_prefix    = "fleet-software-installers-"
      s3_object_prefix = ""
    })
  })
| 
{
  "autoscaling": {
    "cpu_tracking_target_value": 80,
    "max_capacity": 5,
    "memory_tracking_target_value": 80,
    "min_capacity": 1
  },
  "awslogs": {
    "create": true,
    "name": null,
    "prefix": "fleet",
    "region": null,
    "retention": 5
  },
  "cpu": 256,
  "database": {
    "address": null,
    "database": null,
    "password_secret_arn": null,
    "rr_address": null,
    "user": null
  },
  "depends_on": [],
  "extra_environment_variables": {},
  "extra_execution_iam_policies": [],
  "extra_iam_policies": [],
  "extra_load_balacners": [],
  "extra_secrets": {},
  "family": "fleet",
  "iam": {
    "execution": {
      "name": "fleet-execution-role",
      "policy_name": "fleet-iam-policy-execution"
    },
    "role": {
      "name": "fleet-role",
      "policy_name": "fleet-iam-policy"
    }
  },
  "iam_role_arn": null,
  "image": "fleetdm/fleet:v4.54.1",
  "loadbalancer": {
    "arn": null
  },
  "mem": 512,
  "mount_points": [],
  "networking": {
    "ingress_sources": {
      "cidr_blocks": [],
      "ipv6_cidr_blocks": [],
      "prefix_list_ids": [],
      "security_groups": []
    },
    "security_groups": null,
    "subnets": null
  },
  "pid_mode": null,
  "private_key_secret_name": "fleet-server-private-key",
  "redis": {
    "address": null,
    "use_tls": true
  },
  "repository_credentials": "",
  "security_group_name": "fleet",
  "security_groups": null,
  "service": {
    "name": "fleet"
  },
  "sidecars": [],
  "software_installers": {
    "bucket_name": null,
    "bucket_prefix": "fleet-software-installers-",
    "create_bucket": true,
    "s3_object_prefix": ""
  },
  "task_cpu": null,
  "task_mem": null,
  "volumes": []
}
| no | -| [migration\_config](#input\_migration\_config) | The configuration object for Fleet's migration task. | 
object({
    mem = number
    cpu = number
  })
| 
{
  "cpu": 1024,
  "mem": 2048
}
| no | -| [vpc\_id](#input\_vpc\_id) | n/a | `string` | `null` | no | - -## Outputs - -| Name | Description | -|------|-------------| -| [appautoscaling\_target](#output\_appautoscaling\_target) | n/a | -| [execution\_iam\_role\_arn](#output\_execution\_iam\_role\_arn) | n/a | -| [fleet\_config](#output\_fleet\_config) | n/a | -| [fleet\_s3\_software\_installers\_config](#output\_fleet\_s3\_software\_installers\_config) | n/a | -| [fleet\_server\_private\_key\_secret\_arn](#output\_fleet\_server\_private\_key\_secret\_arn) | n/a | -| [iam\_role\_arn](#output\_iam\_role\_arn) | n/a | -| [logging\_config](#output\_logging\_config) | n/a | -| [non\_circular](#output\_non\_circular) | n/a | -| [service](#output\_service) | n/a | -| [task\_definition](#output\_task\_definition) | n/a | diff --git a/terraform/byo-vpc/byo-db/byo-ecs/iam.tf b/terraform/byo-vpc/byo-db/byo-ecs/iam.tf deleted file mode 100644 index c29aa1ad2925..000000000000 --- a/terraform/byo-vpc/byo-db/byo-ecs/iam.tf +++ /dev/null @@ -1,114 +0,0 @@ -data "aws_iam_policy_document" "software_installers" { - count = var.fleet_config.software_installers.create_bucket == true ? 1 : 0 - statement { - actions = [ - "s3:GetObject*", - "s3:PutObject*", - "s3:ListBucket*", - "s3:ListMultipartUploadParts*", - "s3:DeleteObject", - "s3:CreateMultipartUpload", - "s3:AbortMultipartUpload", - "s3:ListMultipartUploadParts", - "s3:GetBucketLocation" - ] - resources = [aws_s3_bucket.software_installers[0].arn, "${aws_s3_bucket.software_installers[0].arn}/*"] - } -} - -resource "aws_iam_policy" "software_installers" { - count = var.fleet_config.software_installers.create_bucket == true ? 1 : 0 - policy = data.aws_iam_policy_document.software_installers[count.index].json -} - -resource "aws_iam_role_policy_attachment" "software_installers" { - count = var.fleet_config.iam_role_arn == null && var.fleet_config.software_installers.create_bucket == true ? 1 : 0 - policy_arn = aws_iam_policy.software_installers[0].arn - role = aws_iam_role.main[0].name -} - -data "aws_iam_policy_document" "fleet" { - statement { - effect = "Allow" - actions = ["cloudwatch:PutMetricData"] - resources = ["*"] - } - -} - -data "aws_iam_policy_document" "assume_role" { - statement { - effect = "Allow" - actions = ["sts:AssumeRole"] - principals { - identifiers = ["ecs.amazonaws.com", "ecs-tasks.amazonaws.com"] - type = "Service" - } - } -} - -data "aws_iam_policy_document" "fleet-execution" { - // allow fleet application to obtain the database password from secrets manager - statement { - effect = "Allow" - actions = ["secretsmanager:GetSecretValue"] - resources = [ - var.fleet_config.database.password_secret_arn, - aws_secretsmanager_secret.fleet_server_private_key.arn - ] - } -} - -resource "aws_iam_role" "main" { - count = var.fleet_config.iam_role_arn == null ? 1 : 0 - name = var.fleet_config.iam.role.name - description = "IAM role that Fleet application assumes when running in ECS" - assume_role_policy = data.aws_iam_policy_document.assume_role.json -} - -resource "aws_iam_policy" "main" { - count = var.fleet_config.iam_role_arn == null ? 1 : 0 - name = var.fleet_config.iam.role.policy_name - description = "IAM policy that Fleet application uses to define access to AWS resources" - policy = data.aws_iam_policy_document.fleet.json -} - -resource "aws_iam_role_policy_attachment" "main" { - count = var.fleet_config.iam_role_arn == null ? 1 : 0 - policy_arn = aws_iam_policy.main[0].arn - role = aws_iam_role.main[0].name -} - -resource "aws_iam_role_policy_attachment" "extras" { - for_each = toset(var.fleet_config.extra_iam_policies) - policy_arn = each.value - role = aws_iam_role.main[0].name -} - -resource "aws_iam_role_policy_attachment" "execution_extras" { - for_each = toset(var.fleet_config.extra_execution_iam_policies) - policy_arn = each.value - role = aws_iam_role.execution.name -} - -resource "aws_iam_policy" "execution" { - name = var.fleet_config.iam.execution.policy_name - description = "IAM policy that Fleet application uses to define access to AWS resources" - policy = data.aws_iam_policy_document.fleet-execution.json -} - -resource "aws_iam_role_policy_attachment" "execution" { - policy_arn = aws_iam_policy.execution.arn - role = aws_iam_role.execution.name -} - -resource "aws_iam_role" "execution" { - name = var.fleet_config.iam.execution.name - description = "The execution role for Fleet in ECS" - assume_role_policy = data.aws_iam_policy_document.assume_role.json -} - -resource "aws_iam_role_policy_attachment" "role_attachment" { - policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy" - role = aws_iam_role.execution.name -} diff --git a/terraform/byo-vpc/byo-db/byo-ecs/main.tf b/terraform/byo-vpc/byo-db/byo-ecs/main.tf deleted file mode 100644 index ab56fe80fa12..000000000000 --- a/terraform/byo-vpc/byo-db/byo-ecs/main.tf +++ /dev/null @@ -1,308 +0,0 @@ -locals { - environment = [for k, v in var.fleet_config.extra_environment_variables : { - name = k - value = v - }] - secrets = [for k, v in var.fleet_config.extra_secrets : { - name = k - valueFrom = v - }] - load_balancers = concat([ - { - target_group_arn = var.fleet_config.loadbalancer.arn - container_name = "fleet" - container_port = 8080 - } - ], var.fleet_config.extra_load_balancers) - repository_credentials = var.fleet_config.repository_credentials != "" ? { - repositoryCredentials = { - credentialsParameter = var.fleet_config.repository_credentials - } - } : null -} - -data "aws_region" "current" {} - -resource "aws_ecs_service" "fleet" { - name = var.fleet_config.service.name - launch_type = "FARGATE" - cluster = var.ecs_cluster - task_definition = aws_ecs_task_definition.backend.arn - desired_count = 1 - deployment_minimum_healthy_percent = 100 - deployment_maximum_percent = 200 - health_check_grace_period_seconds = 30 - - dynamic "load_balancer" { - for_each = local.load_balancers - content { - target_group_arn = load_balancer.value.target_group_arn - container_name = load_balancer.value.container_name - container_port = load_balancer.value.container_port - } - } - - lifecycle { - ignore_changes = [desired_count] - } - - network_configuration { - subnets = var.fleet_config.networking.subnets - security_groups = var.fleet_config.networking.security_groups == null ? aws_security_group.main.*.id : var.fleet_config.networking.security_groups - } -} - -resource "aws_ecs_task_definition" "backend" { - family = var.fleet_config.family - network_mode = "awsvpc" - requires_compatibilities = ["FARGATE"] - task_role_arn = var.fleet_config.iam_role_arn == null ? aws_iam_role.main[0].arn : var.fleet_config.iam_role_arn - execution_role_arn = aws_iam_role.execution.arn - cpu = var.fleet_config.task_cpu == null ? var.fleet_config.cpu : var.fleet_config.task_cpu - memory = var.fleet_config.task_mem == null ? var.fleet_config.mem : var.fleet_config.task_mem - pid_mode = var.fleet_config.pid_mode - container_definitions = jsonencode( - concat([ - { - name = "fleet" - image = var.fleet_config.image - cpu = var.fleet_config.cpu - memory = var.fleet_config.mem - mountPoints = var.fleet_config.mount_points - dependsOn = var.fleet_config.depends_on - volumesFrom = [] - essential = true - portMappings = [ - { - # This port is the same that the contained application also uses - containerPort = 8080 - protocol = "tcp" - } - ] - repositoryCredentials = local.repository_credentials - networkMode = "awsvpc" - logConfiguration = { - logDriver = "awslogs" - options = { - awslogs-group = var.fleet_config.awslogs.create == true ? aws_cloudwatch_log_group.main[0].name : var.fleet_config.awslogs.name - awslogs-region = var.fleet_config.awslogs.create == true ? data.aws_region.current.name : var.fleet_config.awslogs.region - awslogs-stream-prefix = var.fleet_config.awslogs.prefix - } - }, - ulimits = [ - { - name = "nofile" - softLimit = 999999 - hardLimit = 999999 - } - ], - secrets = concat([ - { - name = "FLEET_MYSQL_PASSWORD" - valueFrom = var.fleet_config.database.password_secret_arn - }, - { - name = "FLEET_MYSQL_READ_REPLICA_PASSWORD" - valueFrom = var.fleet_config.database.password_secret_arn - }, - { - name = "FLEET_SERVER_PRIVATE_KEY" - valueFrom = aws_secretsmanager_secret.fleet_server_private_key.arn - } - ], local.secrets) - environment = concat([ - { - name = "FLEET_MYSQL_USERNAME" - value = var.fleet_config.database.user - }, - { - name = "FLEET_MYSQL_DATABASE" - value = var.fleet_config.database.database - }, - { - name = "FLEET_MYSQL_ADDRESS" - value = var.fleet_config.database.address - }, - { - name = "FLEET_MYSQL_READ_REPLICA_USERNAME" - value = var.fleet_config.database.user - }, - { - name = "FLEET_MYSQL_READ_REPLICA_DATABASE" - value = var.fleet_config.database.database - }, - { - name = "FLEET_MYSQL_READ_REPLICA_ADDRESS" - value = var.fleet_config.database.rr_address == null ? var.fleet_config.database.address : var.fleet_config.database.rr_address - }, - { - name = "FLEET_REDIS_ADDRESS" - value = var.fleet_config.redis.address - }, - { - name = "FLEET_REDIS_USE_TLS" - value = tostring(var.fleet_config.redis.use_tls) - }, - { - name = "FLEET_SERVER_TLS" - value = "false" - }, - { - name = "FLEET_S3_SOFTWARE_INSTALLERS_BUCKET" - value = var.fleet_config.software_installers.create_bucket == true ? aws_s3_bucket.software_installers[0].bucket : var.fleet_config.software_installers.bucket_name - }, - { - name = "FLEET_S3_SOFTWARE_INSTALLERS_PREFIX" - value = var.fleet_config.software_installers.s3_object_prefix - }, - ], local.environment) - } - ], var.fleet_config.sidecars)) - dynamic "volume" { - for_each = var.fleet_config.volumes - content { - name = volume.value.name - host_path = lookup(volume.value, "host_path", null) - - dynamic "docker_volume_configuration" { - for_each = lookup(volume.value, "docker_volume_configuration", []) - content { - scope = lookup(docker_volume_configuration.value, "scope", null) - autoprovision = lookup(docker_volume_configuration.value, "autoprovision", null) - driver = lookup(docker_volume_configuration.value, "driver", null) - driver_opts = lookup(docker_volume_configuration.value, "driver_opts", null) - labels = lookup(docker_volume_configuration.value, "labels", null) - } - } - - dynamic "efs_volume_configuration" { - for_each = lookup(volume.value, "efs_volume_configuration", []) - content { - file_system_id = lookup(efs_volume_configuration.value, "file_system_id", null) - root_directory = lookup(efs_volume_configuration.value, "root_directory", null) - } - } - } - } -} - -resource "aws_appautoscaling_target" "ecs_target" { - max_capacity = var.fleet_config.autoscaling.max_capacity - min_capacity = var.fleet_config.autoscaling.min_capacity - resource_id = "service/${var.ecs_cluster}/${aws_ecs_service.fleet.name}" - scalable_dimension = "ecs:service:DesiredCount" - service_namespace = "ecs" -} - -resource "aws_appautoscaling_policy" "ecs_policy_memory" { - name = "${var.fleet_config.family}-memory-autoscaling" - policy_type = "TargetTrackingScaling" - resource_id = aws_appautoscaling_target.ecs_target.resource_id - scalable_dimension = aws_appautoscaling_target.ecs_target.scalable_dimension - service_namespace = aws_appautoscaling_target.ecs_target.service_namespace - - target_tracking_scaling_policy_configuration { - predefined_metric_specification { - predefined_metric_type = "ECSServiceAverageMemoryUtilization" - } - target_value = var.fleet_config.autoscaling.memory_tracking_target_value - } -} - -resource "aws_appautoscaling_policy" "ecs_policy_cpu" { - name = "${var.fleet_config.family}-cpu-autoscaling" - policy_type = "TargetTrackingScaling" - resource_id = aws_appautoscaling_target.ecs_target.resource_id - scalable_dimension = aws_appautoscaling_target.ecs_target.scalable_dimension - service_namespace = aws_appautoscaling_target.ecs_target.service_namespace - - target_tracking_scaling_policy_configuration { - predefined_metric_specification { - predefined_metric_type = "ECSServiceAverageCPUUtilization" - } - - target_value = var.fleet_config.autoscaling.cpu_tracking_target_value - } -} - -resource "aws_cloudwatch_log_group" "main" { #tfsec:ignore:aws-cloudwatch-log-group-customer-key:exp:2022-07-01 - count = var.fleet_config.awslogs.create == true ? 1 : 0 - name = var.fleet_config.awslogs.name - retention_in_days = var.fleet_config.awslogs.retention -} - -resource "aws_security_group" "main" { - count = var.fleet_config.networking.security_groups == null ? 1 : 0 - name = var.fleet_config.security_group_name - description = "Fleet ECS Service Security Group" - vpc_id = var.vpc_id - egress { - description = "Egress to all" - from_port = 0 - to_port = 0 - protocol = "-1" - cidr_blocks = ["0.0.0.0/0"] - ipv6_cidr_blocks = ["::/0"] - } - ingress { - description = "Ingress only on container port" - from_port = 8080 - to_port = 8080 - protocol = "TCP" - cidr_blocks = var.fleet_config.networking.ingress_sources.cidr_blocks - ipv6_cidr_blocks = var.fleet_config.networking.ingress_sources.ipv6_cidr_blocks - security_groups = var.fleet_config.networking.ingress_sources.security_groups - prefix_list_ids = var.fleet_config.networking.ingress_sources.prefix_list_ids - } -} - -resource "random_password" "fleet_server_private_key" { - length = 32 - special = true -} - -resource "aws_secretsmanager_secret" "fleet_server_private_key" { - name = var.fleet_config.private_key_secret_name - - recovery_window_in_days = "0" - lifecycle { - create_before_destroy = true - } -} - -resource "aws_secretsmanager_secret_version" "fleet_server_private_key" { - secret_id = aws_secretsmanager_secret.fleet_server_private_key.id - secret_string = random_password.fleet_server_private_key.result -} - -// Customer keys are not supported in our Fleet Terraforms at the moment. We will evaluate the -// possibility of providing this capability in the future. -// No versioning on this bucket is by design. -// Bucket logging is not supported in our Fleet Terraforms at the moment. It can be enabled by the -// organizations deploying Fleet, and we will evaluate the possibility of providing this capability -// in the future. - -resource "aws_s3_bucket" "software_installers" { #tfsec:ignore:aws-s3-encryption-customer-key:exp:2022-07-01 #tfsec:ignore:aws-s3-enable-versioning #tfsec:ignore:aws-s3-enable-bucket-logging:exp:2022-06-15 - count = var.fleet_config.software_installers.create_bucket == true ? 1 : 0 - bucket = var.fleet_config.software_installers.bucket_name - bucket_prefix = var.fleet_config.software_installers.bucket_prefix -} - -resource "aws_s3_bucket_server_side_encryption_configuration" "software_installers" { - count = var.fleet_config.software_installers.create_bucket == true ? 1 : 0 - bucket = aws_s3_bucket.software_installers[0].bucket - rule { - apply_server_side_encryption_by_default { - sse_algorithm = "aws:kms" - } - } -} - -resource "aws_s3_bucket_public_access_block" "software_installers" { - count = var.fleet_config.software_installers.create_bucket == true ? 1 : 0 - bucket = aws_s3_bucket.software_installers[0].id - block_public_acls = true - block_public_policy = true - ignore_public_acls = true - restrict_public_buckets = true -} diff --git a/terraform/byo-vpc/byo-db/byo-ecs/outputs.tf b/terraform/byo-vpc/byo-db/byo-ecs/outputs.tf deleted file mode 100644 index 4c72c7a0b07a..000000000000 --- a/terraform/byo-vpc/byo-db/byo-ecs/outputs.tf +++ /dev/null @@ -1,51 +0,0 @@ -output "service" { - value = aws_ecs_service.fleet -} - -output "appautoscaling_target" { - value = aws_appautoscaling_target.ecs_target -} - -output "task_definition" { - value = aws_ecs_task_definition.backend -} - -output "iam_role_arn" { - # Always respond sanely even if we did not generate - value = var.fleet_config.iam_role_arn == null ? aws_iam_role.main[0].arn : var.fleet_config.iam_role_arn -} - -output "execution_iam_role_arn" { - value = aws_iam_role.execution.arn -} - -output "logging_config" { - # Always respond sanely even if we did not generate - value = { - awslogs-group = var.fleet_config.awslogs.create == true ? aws_cloudwatch_log_group.main[0].name : var.fleet_config.awslogs.name - awslogs-region = var.fleet_config.awslogs.create == true ? data.aws_region.current.name : var.fleet_config.awslogs.region - awslogs-stream-prefix = var.fleet_config.awslogs.prefix - } -} - -output "non_circular" { - value = { - "security_groups" = var.fleet_config.networking.security_groups == null ? aws_security_group.main.*.id : var.fleet_config.networking.security_groups, - "subnets" = var.fleet_config.networking.subnets, - } -} - -output "fleet_config" { - value = var.fleet_config -} - -output "fleet_server_private_key_secret_arn" { - value = aws_secretsmanager_secret.fleet_server_private_key.arn -} - -output "fleet_s3_software_installers_config" { - value = { - bucket_name = var.fleet_config.software_installers.create_bucket == true ? aws_s3_bucket.software_installers[0].bucket : var.fleet_config.software_installers.bucket_name - s3_object_prefix = var.fleet_config.software_installers.s3_object_prefix - } -} diff --git a/terraform/byo-vpc/byo-db/byo-ecs/variables.tf b/terraform/byo-vpc/byo-db/byo-ecs/variables.tf deleted file mode 100644 index a9403a240699..000000000000 --- a/terraform/byo-vpc/byo-db/byo-ecs/variables.tf +++ /dev/null @@ -1,209 +0,0 @@ -variable "ecs_cluster" { - type = string - description = "The name of the ECS cluster to use" - nullable = false -} - -variable "vpc_id" { - type = string - default = null -} - -variable "fleet_config" { - type = object({ - task_mem = optional(number, null) - task_cpu = optional(number, null) - mem = optional(number, 4096) - cpu = optional(number, 512) - pid_mode = optional(string, null) - image = optional(string, "fleetdm/fleet:v4.63.0") - family = optional(string, "fleet") - sidecars = optional(list(any), []) - depends_on = optional(list(any), []) - mount_points = optional(list(any), []) - volumes = optional(list(any), []) - extra_environment_variables = optional(map(string), {}) - extra_iam_policies = optional(list(string), []) - extra_execution_iam_policies = optional(list(string), []) - extra_secrets = optional(map(string), {}) - security_group_name = optional(string, "fleet") - iam_role_arn = optional(string, null) - repository_credentials = optional(string, "") - private_key_secret_name = optional(string, "fleet-server-private-key") - service = optional(object({ - name = optional(string, "fleet") - }), { - name = "fleet" - }) - database = object({ - password_secret_arn = string - user = string - database = string - address = string - rr_address = optional(string, null) - }) - redis = object({ - address = string - use_tls = optional(bool, true) - }) - awslogs = optional(object({ - name = optional(string, null) - region = optional(string, null) - create = optional(bool, true) - prefix = optional(string, "fleet") - retention = optional(number, 5) - }), { - name = null - region = null - prefix = "fleet" - retention = 5 - }) - loadbalancer = object({ - arn = string - }) - extra_load_balancers = optional(list(any), []) - networking = object({ - subnets = optional(list(string), null) - security_groups = optional(list(string), null) - ingress_sources = object({ - cidr_blocks = optional(list(string), []) - ipv6_cidr_blocks = optional(list(string), []) - security_groups = optional(list(string), []) - prefix_list_ids = optional(list(string), []) - }) - }) - autoscaling = optional(object({ - max_capacity = optional(number, 5) - min_capacity = optional(number, 1) - memory_tracking_target_value = optional(number, 80) - cpu_tracking_target_value = optional(number, 80) - }), { - max_capacity = 5 - min_capacity = 1 - memory_tracking_target_value = 80 - cpu_tracking_target_value = 80 - }) - iam = optional(object({ - role = optional(object({ - name = optional(string, "fleet-role") - policy_name = optional(string, "fleet-iam-policy") - }), { - name = "fleet-role" - policy_name = "fleet-iam-policy" - }) - execution = optional(object({ - name = optional(string, "fleet-execution-role") - policy_name = optional(string, "fleet-execution-role") - }), { - name = "fleet-execution-role" - policy_name = "fleet-iam-policy-execution" - }) - }), { - name = "fleetdm-execution-role" - }) - software_installers = optional(object({ - create_bucket = optional(bool, true) - bucket_name = optional(string, null) - bucket_prefix = optional(string, "fleet-software-installers-") - s3_object_prefix = optional(string, "") - }), { - create_bucket = true - bucket_name = null - bucket_prefix = "fleet-software-installers-" - s3_object_prefix = "" - }) - }) - default = { - task_mem = null - task_cpu = null - mem = 512 - cpu = 256 - pid_mode = null - image = "fleetdm/fleet:v4.63.0" - family = "fleet" - sidecars = [] - depends_on = [] - mount_points = [] - volumes = [] - extra_environment_variables = {} - extra_iam_policies = [] - extra_execution_iam_policies = [] - extra_secrets = {} - security_group_name = "fleet" - iam_role_arn = null - repository_credentials = "" - private_key_secret_name = "fleet-server-private-key" - service = { - name = "fleet" - } - database = { - password_secret_arn = null - user = null - database = null - address = null - rr_address = null - } - redis = { - address = null - use_tls = true - } - awslogs = { - name = null - region = null - create = true - prefix = "fleet" - retention = 5 - } - loadbalancer = { - arn = null - } - extra_load_balacners = [] - networking = { - subnets = null - security_groups = null - ingress_sources = { - cidr_blocks = [] - ipv6_cidr_blocks = [] - security_groups = [] - prefix_list_ids = [] - } - } - autoscaling = { - max_capacity = 5 - min_capacity = 1 - memory_tracking_target_value = 80 - cpu_tracking_target_value = 80 - } - iam = { - role = { - name = "fleet-role" - policy_name = "fleet-iam-policy" - } - execution = { - name = "fleet-execution-role" - policy_name = "fleet-iam-policy-execution" - } - } - software_installers = { - create_bucket = true - bucket_name = null - bucket_prefix = "fleet-software-installers-" - s3_object_prefix = "" - } - } - description = "The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified." - nullable = false -} - -variable "migration_config" { - type = object({ - mem = number - cpu = number - }) - default = { - mem = 2048 - cpu = 1024 - } - description = "The configuration object for Fleet's migration task." - nullable = false -} diff --git a/terraform/byo-vpc/byo-db/main.tf b/terraform/byo-vpc/byo-db/main.tf deleted file mode 100644 index 45cd4e79f654..000000000000 --- a/terraform/byo-vpc/byo-db/main.tf +++ /dev/null @@ -1,131 +0,0 @@ -locals { - fleet_config = merge(var.fleet_config, { - loadbalancer = { - arn = module.alb.target_group_arns[0] - }, - networking = merge(var.fleet_config.networking, { - subnets = var.fleet_config.networking.subnets - security_groups = var.fleet_config.networking.security_groups - ingress_sources = { - cidr_blocks = var.fleet_config.networking.ingress_sources.cidr_blocks - ipv6_cidr_blocks = var.fleet_config.networking.ingress_sources.ipv6_cidr_blocks - security_groups = concat(var.fleet_config.networking.ingress_sources.security_groups, [module.alb.security_group_id]) - prefix_list_ids = var.fleet_config.networking.ingress_sources.prefix_list_ids - } - }) - }) - -} - -module "ecs" { - source = "./byo-ecs" - ecs_cluster = module.cluster.cluster_name - fleet_config = local.fleet_config - migration_config = var.migration_config - vpc_id = var.vpc_id -} - -module "cluster" { - source = "terraform-aws-modules/ecs/aws" - version = "4.1.2" - - autoscaling_capacity_providers = var.ecs_cluster.autoscaling_capacity_providers - cluster_configuration = var.ecs_cluster.cluster_configuration - cluster_name = var.ecs_cluster.cluster_name - cluster_settings = var.ecs_cluster.cluster_settings - create = var.ecs_cluster.create - default_capacity_provider_use_fargate = var.ecs_cluster.default_capacity_provider_use_fargate - fargate_capacity_providers = var.ecs_cluster.fargate_capacity_providers - tags = var.ecs_cluster.tags -} - -module "alb" { - source = "terraform-aws-modules/alb/aws" - version = "8.3.0" - - name = var.alb_config.name - - load_balancer_type = "application" - - vpc_id = var.vpc_id - subnets = var.alb_config.subnets - security_groups = concat(var.alb_config.security_groups, [aws_security_group.alb.id]) - access_logs = var.alb_config.access_logs - idle_timeout = var.alb_config.idle_timeout - - target_groups = concat([ - { - name = var.alb_config.name - backend_protocol = "HTTP" - backend_port = 80 - target_type = "ip" - health_check = { - path = "/healthz" - matcher = "200" - timeout = 10 - interval = 15 - healthy_threshold = 5 - unhealthy_threshold = 5 - } - } - ], var.alb_config.extra_target_groups) - - # Require TLS 1.2 as earlier versions are insecure - listener_ssl_policy_default = var.alb_config.tls_policy - - https_listeners = [ - { - port = 443 - protocol = "HTTPS" - certificate_arn = var.alb_config.certificate_arn - target_group_index = 0 - } - ] - - https_listener_rules = var.alb_config.https_listener_rules - - http_tcp_listeners = [ - { - port = 80 - protocol = "HTTP" - action_type = "redirect" - redirect = { - port = "443" - protocol = "HTTPS" - status_code = "HTTP_301" - } - } - ] -} - -resource "aws_security_group" "alb" { - #checkov:skip=CKV2_AWS_5:False positive - vpc_id = var.vpc_id - description = "Fleet ALB Security Group" - ingress { - description = "Ingress from all, its a public load balancer" - from_port = 443 - to_port = 443 - protocol = "tcp" - cidr_blocks = var.alb_config.allowed_cidrs - ipv6_cidr_blocks = var.alb_config.allowed_ipv6_cidrs - } - - ingress { - description = "For http to https redirect" - from_port = 80 - to_port = 80 - protocol = "tcp" - cidr_blocks = var.alb_config.allowed_cidrs - ipv6_cidr_blocks = var.alb_config.allowed_ipv6_cidrs - } - - egress { - description = "Egress to all" - from_port = 0 - to_port = 0 - protocol = "-1" - cidr_blocks = var.alb_config.egress_cidrs - ipv6_cidr_blocks = var.alb_config.egress_ipv6_cidrs - } -} diff --git a/terraform/byo-vpc/byo-db/outputs.tf b/terraform/byo-vpc/byo-db/outputs.tf deleted file mode 100644 index 85875f0c2132..000000000000 --- a/terraform/byo-vpc/byo-db/outputs.tf +++ /dev/null @@ -1,11 +0,0 @@ -output "byo-ecs" { - value = module.ecs -} - -output "cluster" { - value = module.cluster -} - -output "alb" { - value = module.alb -} diff --git a/terraform/byo-vpc/byo-db/variables.tf b/terraform/byo-vpc/byo-db/variables.tf deleted file mode 100644 index a076dd350bed..000000000000 --- a/terraform/byo-vpc/byo-db/variables.tf +++ /dev/null @@ -1,314 +0,0 @@ -variable "vpc_id" { - type = string -} - -variable "ecs_cluster" { - type = object({ - autoscaling_capacity_providers = optional(any, {}) - cluster_configuration = optional(any, { - execute_command_configuration = { - logging = "OVERRIDE" - log_configuration = { - cloud_watch_log_group_name = "/aws/ecs/aws-ec2" - } - } - }) - cluster_name = optional(string, "fleet") - cluster_settings = optional(map(string), { - "name" : "containerInsights", - "value" : "enabled", - }) - create = optional(bool, true) - default_capacity_provider_use_fargate = optional(bool, true) - fargate_capacity_providers = optional(any, { - FARGATE = { - default_capacity_provider_strategy = { - weight = 100 - } - } - FARGATE_SPOT = { - default_capacity_provider_strategy = { - weight = 0 - } - } - }) - tags = optional(map(string)) - }) - default = { - autoscaling_capacity_providers = {} - cluster_configuration = { - execute_command_configuration = { - logging = "OVERRIDE" - log_configuration = { - cloud_watch_log_group_name = "/aws/ecs/aws-ec2" - } - } - } - cluster_name = "fleet" - cluster_settings = { - "name" : "containerInsights", - "value" : "enabled", - } - create = true - default_capacity_provider_use_fargate = true - fargate_capacity_providers = { - FARGATE = { - default_capacity_provider_strategy = { - weight = 100 - } - } - FARGATE_SPOT = { - default_capacity_provider_strategy = { - weight = 0 - } - } - } - tags = {} - } - description = "The config for the terraform-aws-modules/ecs/aws module" - nullable = false -} - - -variable "fleet_config" { - type = object({ - task_mem = optional(number, null) - task_cpu = optional(number, null) - mem = optional(number, 4096) - cpu = optional(number, 512) - pid_mode = optional(string, null) - image = optional(string, "fleetdm/fleet:v4.63.0") - family = optional(string, "fleet") - sidecars = optional(list(any), []) - depends_on = optional(list(any), []) - mount_points = optional(list(any), []) - volumes = optional(list(any), []) - extra_environment_variables = optional(map(string), {}) - extra_iam_policies = optional(list(string), []) - extra_execution_iam_policies = optional(list(string), []) - extra_secrets = optional(map(string), {}) - security_group_name = optional(string, "fleet") - iam_role_arn = optional(string, null) - repository_credentials = optional(string, "") - private_key_secret_name = optional(string, "fleet-server-private-key") - service = optional(object({ - name = optional(string, "fleet") - }), { - name = "fleet" - }) - database = optional(object({ - password_secret_arn = string - user = string - database = string - address = string - rr_address = optional(string, null) - }), { - password_secret_arn = null - user = null - database = null - address = null - rr_address = null - }) - redis = optional(object({ - address = string - use_tls = optional(bool, true) - }), { - address = null - use_tls = true - }) - awslogs = optional(object({ - name = optional(string, null) - region = optional(string, null) - create = optional(bool, true) - prefix = optional(string, "fleet") - retention = optional(number, 5) - }), { - name = null - region = null - prefix = "fleet" - retention = 5 - }) - loadbalancer = optional(object({ - arn = string - }), { - arn = null - }) - extra_load_balancers = optional(list(any), []) - networking = optional(object({ - subnets = optional(list(string), null) - security_groups = optional(list(string), null) - ingress_sources = optional(object({ - cidr_blocks = optional(list(string), []) - ipv6_cidr_blocks = optional(list(string), []) - security_groups = optional(list(string), []) - prefix_list_ids = optional(list(string), []) - }), { - cidr_blocks = [] - ipv6_cidr_blocks = [] - security_groups = [] - prefix_list_ids = [] - }) - }), { - subnets = null - security_groups = null - ingress_sources = { - cidr_blocks = [] - ipv6_cidr_blocks = [] - security_groups = [] - prefix_list_ids = [] - } - }) - autoscaling = optional(object({ - max_capacity = optional(number, 5) - min_capacity = optional(number, 1) - memory_tracking_target_value = optional(number, 80) - cpu_tracking_target_value = optional(number, 80) - }), { - max_capacity = 5 - min_capacity = 1 - memory_tracking_target_value = 80 - cpu_tracking_target_value = 80 - }) - iam = optional(object({ - role = optional(object({ - name = optional(string, "fleet-role") - policy_name = optional(string, "fleet-iam-policy") - }), { - name = "fleet-role" - policy_name = "fleet-iam-policy" - }) - execution = optional(object({ - name = optional(string, "fleet-execution-role") - policy_name = optional(string, "fleet-execution-role") - }), { - name = "fleet-execution-role" - policy_name = "fleet-iam-policy-execution" - }) - }), { - name = "fleetdm-execution-role" - }) - software_installers = optional(object({ - create_bucket = optional(bool, true) - bucket_name = optional(string, null) - bucket_prefix = optional(string, "fleet-software-installers-") - s3_object_prefix = optional(string, "") - }), { - create_bucket = true - bucket_name = null - bucket_prefix = "fleet-software-installers-" - s3_object_prefix = "" - }) - }) - default = { - task_mem = null - task_cpu = null - mem = 512 - cpu = 256 - pid_mode = null - image = "fleetdm/fleet:v4.63.0" - family = "fleet" - sidecars = [] - depends_on = [] - volumes = [] - mount_points = [] - extra_environment_variables = {} - extra_iam_policies = [] - extra_execution_iam_policies = [] - extra_secrets = {} - security_groups = null - security_group_name = "fleet" - iam_role_arn = null - repository_credentials = "" - private_key_secret_name = "fleet-server-private-key" - service = { - name = "fleet" - } - database = { - password_secret_arn = null - user = null - database = null - address = null - rr_address = null - } - redis = { - address = null - use_tls = true - } - awslogs = { - name = null - region = null - create = true - prefix = "fleet" - retention = 5 - } - loadbalancer = { - arn = null - } - extra_load_balancers = [] - networking = { - subnets = null - security_groups = null - ingress_sources = { - cidr_blocks = [] - ipv6_cidr_blocks = [] - security_groups = [] - prefix_list_ids = [] - } - } - autoscaling = { - max_capacity = 5 - min_capacity = 1 - memory_tracking_target_value = 80 - cpu_tracking_target_value = 80 - } - iam = { - role = { - name = "fleet-role" - policy_name = "fleet-iam-policy" - } - execution = { - name = "fleet-execution-role" - policy_name = "fleet-iam-policy-execution" - } - } - software_installers = { - create_bucket = true - bucket_name = null - bucket_prefix = "fleet-software-installers-" - s3_object_prefix = "" - } - } - description = "The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified." - nullable = false -} - -variable "migration_config" { - type = object({ - mem = number - cpu = number - }) - default = { - mem = 2048 - cpu = 1024 - } - description = "The configuration object for Fleet's migration task." - nullable = false -} - -variable "alb_config" { - type = object({ - name = optional(string, "fleet") - subnets = list(string) - security_groups = optional(list(string), []) - access_logs = optional(map(string), {}) - certificate_arn = string - allowed_cidrs = optional(list(string), ["0.0.0.0/0"]) - allowed_ipv6_cidrs = optional(list(string), ["::/0"]) - egress_cidrs = optional(list(string), ["0.0.0.0/0"]) - egress_ipv6_cidrs = optional(list(string), ["::/0"]) - extra_target_groups = optional(any, []) - https_listener_rules = optional(any, []) - tls_policy = optional(string, "ELBSecurityPolicy-TLS-1-2-2017-01") - idle_timeout = optional(number, 905) - }) -} diff --git a/terraform/byo-vpc/example/main.tf b/terraform/byo-vpc/example/main.tf deleted file mode 100644 index e5eee06dcef3..000000000000 --- a/terraform/byo-vpc/example/main.tf +++ /dev/null @@ -1,160 +0,0 @@ -terraform { - required_version = ">= 1.3.8" - required_providers { - aws = { - source = "hashicorp/aws" - version = "~> 5.0" - } - } -} - -provider "aws" { - default_tags { - tags = { - Example = "This is a demo of the Fleet terraform module" - } - } -} - -locals { - fleet_image = "fleetdm/fleet:v4.63.0" - domain_name = "example.com" -} - -resource "random_pet" "main" {} - -module "acm" { - source = "terraform-aws-modules/acm/aws" - version = "4.3.1" - - domain_name = "${random_pet.main.id}.${local.domain_name}" - zone_id = data.aws_route53_zone.main.id - - wait_for_validation = true -} - -resource "aws_route53_record" "main" { - zone_id = data.aws_route53_zone.main.id - name = "${random_pet.main.id}.${local.domain_name}" - type = "A" - - alias { - name = module.byo-vpc.byo-db.alb.lb_dns_name - zone_id = module.byo-vpc.byo-db.alb.lb_zone_id - evaluate_target_health = true - } -} - -data "aws_route53_zone" "main" { - name = "${local.domain_name}." - private_zone = false -} - -module "firehose-logging" { - source = "github.com/fleetdm/fleet//terraform/addons/logging-destination-firehose?ref=tf-mod-addon-logging-destination-firehose-v1.1.0" - osquery_results_s3_bucket = { - name = "${random_pet.main.id}-results" - } - osquery_status_s3_bucket = { - name = "${random_pet.main.id}-status" - } -} - -module "vpc" { - source = "terraform-aws-modules/vpc/aws" - version = "5.1.2" - - name = random_pet.main.id - cidr = "10.10.0.0/16" - - azs = ["us-east-2a", "us-east-2b", "us-east-2c"] - private_subnets = ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"] - public_subnets = ["10.10.11.0/24", "10.10.12.0/24", "10.10.13.0/24"] - database_subnets = ["10.10.21.0/24", "10.10.22.0/24", "10.10.23.0/24"] - elasticache_subnets = ["10.10.31.0/24", "10.10.32.0/24", "10.10.33.0/24"] - create_database_subnet_group = false - create_database_subnet_route_table = true - create_elasticache_subnet_group = true - create_elasticache_subnet_route_table = true - enable_vpn_gateway = false - one_nat_gateway_per_az = false - single_nat_gateway = true - enable_nat_gateway = true - enable_flow_log = false - create_flow_log_cloudwatch_log_group = false - create_flow_log_cloudwatch_iam_role = false - flow_log_max_aggregation_interval = null - flow_log_cloudwatch_log_group_name_prefix = null - flow_log_cloudwatch_log_group_name_suffix = null - vpc_flow_log_tags = {} - enable_dns_hostnames = false - enable_dns_support = true -} - -module "byo-vpc" { - source = "github.com/fleetdm/fleet//terraform/byo-vpc?ref=tf-mod-byo-vpc-v1.10.1" - vpc_config = { - vpc_id = module.vpc.vpc_id - networking = { - subnets = module.vpc.private_subnets - } - } - rds_config = { - name = random_pet.main.id - instance_class = "db.t4g.large" - subnets = module.vpc.database_subnets - } - redis_config = { - instance_size = "cache.m6g.large" - subnets = module.vpc.elasticache_subnets - elasticache_subnet_group_name = module.vpc.elasticache_subnet_group_name - availability_zones = module.vpc.azs - allowed_cidrs = module.vpc.private_subnets_cidr_blocks - } - alb_config = { - subnets = module.vpc.public_subnets - certificate_arn = module.acm.acm_certificate_arn - https_listener_rules = [{ - https_listener_index = 0 - actions = [{ - type = "fixed-response" - content_type = "text/plain" - status_code = "200" - message_body = "This message is delivered instead of Fleet." - - }] - conditions = [{ - http_headers = [{ - http_header_name = "X-Fixed-Response" - values = ["yes", "true"] - }] - }] - }] - } - ecs_cluster = { - cluster_name = random_pet.main.id - } - fleet_config = { - image = local.fleet_image - cpu = 512 - autoscaling = { - min_capacity = 2 - max_capacity = 5 - } - extra_secrets = { - // FLEET_LICENSE_KEY: "secret_manager_license_key_arn" - } - extra_environment_variables = module.firehose-logging.fleet_extra_environment_variables - extra_iam_policies = module.firehose-logging.fleet_extra_iam_policies - } -} - -module "migrations" { - source = "github.com/fleetdm/fleet//terraform/addons/migrations?ref=tf-mod-addon-migrations-v1.0.0" - ecs_cluster = module.byo-vpc.byo-db.byo-ecs.service.cluster - task_definition = module.byo-vpc.byo-db.byo-ecs.task_definition.family - task_definition_revision = module.byo-vpc.byo-db.byo-ecs.task_definition.revision - subnets = module.byo-vpc.byo-db.byo-ecs.service.network_configuration[0].subnets - security_groups = module.byo-vpc.byo-db.byo-ecs.service.network_configuration[0].security_groups -} - diff --git a/terraform/byo-vpc/main.tf b/terraform/byo-vpc/main.tf deleted file mode 100644 index 3f86bf1372eb..000000000000 --- a/terraform/byo-vpc/main.tf +++ /dev/null @@ -1,151 +0,0 @@ -module "byo-db" { - source = "./byo-db" - vpc_id = var.vpc_config.vpc_id - fleet_config = merge(var.fleet_config, { - database = { - address = module.rds.cluster_endpoint - rr_address = module.rds.cluster_reader_endpoint - database = "fleet" - user = "fleet" - password_secret_arn = module.secrets-manager-1.secret_arns["${var.rds_config.name}-database-password"] - } - redis = { - address = "${module.redis.endpoint}:${module.redis.port}" - } - networking = { - subnets = var.vpc_config.networking.subnets - security_groups = var.fleet_config.networking.security_groups - ingress_sources = var.fleet_config.networking.ingress_sources - } - }) - ecs_cluster = var.ecs_cluster - migration_config = var.migration_config - alb_config = var.alb_config -} - -resource "random_password" "rds" { - length = 16 - special = true - override_special = "!#$%&*()-_=+[]{}<>:?" -} - -module "rds" { - source = "terraform-aws-modules/rds-aurora/aws" - version = "7.6.0" - - name = var.rds_config.name - engine = "aurora-mysql" - engine_version = var.rds_config.engine_version - instance_class = var.rds_config.instance_class - - instances = { - one = {} - two = {} - } - - vpc_id = var.vpc_config.vpc_id - subnets = var.rds_config.subnets - - allowed_security_groups = concat(tolist(module.byo-db.byo-ecs.non_circular.security_groups), var.rds_config.allowed_security_groups) - allowed_cidr_blocks = var.rds_config.allowed_cidr_blocks - - performance_insights_enabled = true - storage_encrypted = true - apply_immediately = var.rds_config.apply_immediately - monitoring_interval = var.rds_config.monitoring_interval - - db_parameter_group_name = var.rds_config.db_parameter_group_name == null ? aws_db_parameter_group.main[0].id : var.rds_config.db_parameter_group_name - db_cluster_parameter_group_name = var.rds_config.db_cluster_parameter_group_name == null ? aws_rds_cluster_parameter_group.main[0].id : var.rds_config.db_cluster_parameter_group_name - - enabled_cloudwatch_logs_exports = var.rds_config.enabled_cloudwatch_logs_exports - master_username = var.rds_config.master_username - master_password = random_password.rds.result - database_name = "fleet" - skip_final_snapshot = true - snapshot_identifier = var.rds_config.snapshot_identifier - - preferred_maintenance_window = var.rds_config.preferred_maintenance_window - - cluster_tags = var.rds_config.cluster_tags -} - -data "aws_subnet" "redis" { - for_each = toset(var.redis_config.subnets) - id = each.value -} - -module "redis" { - source = "cloudposse/elasticache-redis/aws" - version = "0.53.0" - - name = var.redis_config.name - replication_group_id = var.redis_config.replication_group_id == null ? var.redis_config.name : var.redis_config.replication_group_id - elasticache_subnet_group_name = var.redis_config.elasticache_subnet_group_name == null ? var.redis_config.name : var.redis_config.elasticache_subnet_group_name - availability_zones = var.redis_config.availability_zones - vpc_id = var.vpc_config.vpc_id - description = "Fleet Redis" - #allowed_security_group_ids = concat(var.redis_config.allowed_security_group_ids, module.byo-db.ecs.security_group) - subnets = var.redis_config.subnets - cluster_size = var.redis_config.cluster_size - instance_type = var.redis_config.instance_type - apply_immediately = var.redis_config.apply_immediately - automatic_failover_enabled = var.redis_config.automatic_failover_enabled - engine_version = var.redis_config.engine_version - family = var.redis_config.family - at_rest_encryption_enabled = var.redis_config.at_rest_encryption_enabled - transit_encryption_enabled = var.redis_config.transit_encryption_enabled - parameter = var.redis_config.parameter - log_delivery_configuration = var.redis_config.log_delivery_configuration - additional_security_group_rules = [{ - type = "ingress" - from_port = 0 - to_port = 65535 - protocol = "tcp" - cidr_blocks = var.redis_config.allowed_cidrs - }] - tags = var.redis_config.tags -} - -module "secrets-manager-1" { - source = "lgallard/secrets-manager/aws" - version = "0.6.1" - - secrets = { - "${var.rds_config.name}-database-password" = { - description = "fleet-database-password" - recovery_window_in_days = 0 - secret_string = module.rds.cluster_master_password - }, - } -} - -resource "aws_db_parameter_group" "main" { - count = var.rds_config.db_parameter_group_name == null ? 1 : 0 - name = var.rds_config.name - family = "aurora-mysql8.0" - description = "fleet" - - dynamic "parameter" { - for_each = var.rds_config.db_parameters - content { - name = parameter.key - value = parameter.value - } - } -} - -resource "aws_rds_cluster_parameter_group" "main" { - count = var.rds_config.db_cluster_parameter_group_name == null ? 1 : 0 - name = var.rds_config.name - family = "aurora-mysql8.0" - description = "fleet" - - dynamic "parameter" { - for_each = var.rds_config.db_cluster_parameters - content { - name = parameter.key - value = parameter.value - } - } - -} diff --git a/terraform/byo-vpc/outputs.tf b/terraform/byo-vpc/outputs.tf deleted file mode 100644 index 4473d0d56861..000000000000 --- a/terraform/byo-vpc/outputs.tf +++ /dev/null @@ -1,15 +0,0 @@ -output "byo-db" { - value = module.byo-db -} - -output "rds" { - value = module.rds -} - -output "redis" { - value = module.redis -} - -output "secrets" { - value = module.secrets-manager-1 -} diff --git a/terraform/byo-vpc/variables.tf b/terraform/byo-vpc/variables.tf deleted file mode 100644 index 70d737252542..000000000000 --- a/terraform/byo-vpc/variables.tf +++ /dev/null @@ -1,407 +0,0 @@ -variable "vpc_config" { - type = object({ - vpc_id = string - networking = object({ - subnets = list(string) - }) - }) -} - -variable "rds_config" { - type = object({ - name = optional(string, "fleet") - engine_version = optional(string, "8.0.mysql_aurora.3.07.1") - instance_class = optional(string, "db.t4g.large") - subnets = optional(list(string), []) - allowed_security_groups = optional(list(string), []) - allowed_cidr_blocks = optional(list(string), []) - apply_immediately = optional(bool, true) - monitoring_interval = optional(number, 10) - db_parameter_group_name = optional(string) - db_parameters = optional(map(string), {}) - db_cluster_parameter_group_name = optional(string) - db_cluster_parameters = optional(map(string), {}) - enabled_cloudwatch_logs_exports = optional(list(string), []) - master_username = optional(string, "fleet") - snapshot_identifier = optional(string) - cluster_tags = optional(map(string), {}) - preferred_maintenance_window = optional(string, "thu:23:00-fri:00:00") - }) - default = { - name = "fleet" - engine_version = "8.0.mysql_aurora.3.07.1" - instance_class = "db.t4g.large" - subnets = [] - allowed_security_groups = [] - allowed_cidr_blocks = [] - apply_immediately = true - monitoring_interval = 10 - db_parameter_group_name = null - db_parameters = {} - db_cluster_parameter_group_name = null - db_cluster_parameters = {} - enabled_cloudwatch_logs_exports = [] - master_username = "fleet" - snapshot_identifier = null - cluster_tags = {} - preferred_maintenance_window = "thu:23:00-fri:00:00" - } - description = "The config for the terraform-aws-modules/rds-aurora/aws module" - nullable = false -} - -variable "redis_config" { - type = object({ - name = optional(string, "fleet") - replication_group_id = optional(string) - elasticache_subnet_group_name = optional(string, "") - allowed_security_group_ids = optional(list(string), []) - subnets = list(string) - allowed_cidrs = list(string) - availability_zones = optional(list(string), []) - cluster_size = optional(number, 3) - instance_type = optional(string, "cache.m5.large") - apply_immediately = optional(bool, true) - automatic_failover_enabled = optional(bool, false) - engine_version = optional(string, "6.x") - family = optional(string, "redis6.x") - at_rest_encryption_enabled = optional(bool, true) - transit_encryption_enabled = optional(bool, true) - parameter = optional(list(object({ - name = string - value = string - })), []) - log_delivery_configuration = optional(list(map(any)), []) - tags = optional(map(string), {}) - }) - default = { - name = "fleet" - replication_group_id = null - elasticache_subnet_group_name = "" - allowed_security_group_ids = [] - subnets = null - allowed_cidrs = null - availability_zones = [] - cluster_size = 3 - instance_type = "cache.m5.large" - apply_immediately = true - automatic_failover_enabled = false - engine_version = "6.x" - family = "redis6.x" - at_rest_encryption_enabled = true - transit_encryption_enabled = true - parameter = [] - log_delivery_configuration = [] - tags = {} - } -} - -variable "ecs_cluster" { - type = object({ - autoscaling_capacity_providers = optional(any, {}) - cluster_configuration = optional(any, { - execute_command_configuration = { - logging = "OVERRIDE" - log_configuration = { - cloud_watch_log_group_name = "/aws/ecs/aws-ec2" - } - } - }) - cluster_name = optional(string, "fleet") - cluster_settings = optional(map(string), { - "name" : "containerInsights", - "value" : "enabled", - }) - create = optional(bool, true) - default_capacity_provider_use_fargate = optional(bool, true) - fargate_capacity_providers = optional(any, { - FARGATE = { - default_capacity_provider_strategy = { - weight = 100 - } - } - FARGATE_SPOT = { - default_capacity_provider_strategy = { - weight = 0 - } - } - }) - tags = optional(map(string)) - }) - default = { - autoscaling_capacity_providers = {} - cluster_configuration = { - execute_command_configuration = { - logging = "OVERRIDE" - log_configuration = { - cloud_watch_log_group_name = "/aws/ecs/aws-ec2" - } - } - } - cluster_name = "fleet" - cluster_settings = { - "name" : "containerInsights", - "value" : "enabled", - } - create = true - default_capacity_provider_use_fargate = true - fargate_capacity_providers = { - FARGATE = { - default_capacity_provider_strategy = { - weight = 100 - } - } - FARGATE_SPOT = { - default_capacity_provider_strategy = { - weight = 0 - } - } - } - tags = {} - } - description = "The config for the terraform-aws-modules/ecs/aws module" - nullable = false -} - -variable "fleet_config" { - type = object({ - task_mem = optional(number, null) - task_cpu = optional(number, null) - mem = optional(number, 4096) - cpu = optional(number, 512) - pid_mode = optional(string, null) - image = optional(string, "fleetdm/fleet:v4.63.0") - family = optional(string, "fleet") - sidecars = optional(list(any), []) - depends_on = optional(list(any), []) - mount_points = optional(list(any), []) - volumes = optional(list(any), []) - extra_environment_variables = optional(map(string), {}) - extra_iam_policies = optional(list(string), []) - extra_execution_iam_policies = optional(list(string), []) - extra_secrets = optional(map(string), {}) - security_group_name = optional(string, "fleet") - iam_role_arn = optional(string, null) - repository_credentials = optional(string, "") - private_key_secret_name = optional(string, "fleet-server-private-key") - service = optional(object({ - name = optional(string, "fleet") - }), { - name = "fleet" - }) - database = optional(object({ - password_secret_arn = string - user = string - database = string - address = string - rr_address = optional(string, null) - }), { - password_secret_arn = null - user = null - database = null - address = null - rr_address = null - }) - redis = optional(object({ - address = string - use_tls = optional(bool, true) - }), { - address = null - use_tls = true - }) - awslogs = optional(object({ - name = optional(string, null) - region = optional(string, null) - create = optional(bool, true) - prefix = optional(string, "fleet") - retention = optional(number, 5) - }), { - name = null - region = null - prefix = "fleet" - retention = 5 - }) - loadbalancer = optional(object({ - arn = string - }), { - arn = null - }) - extra_load_balancers = optional(list(any), []) - networking = optional(object({ - subnets = optional(list(string), null) - security_groups = optional(list(string), null) - ingress_sources = optional(object({ - cidr_blocks = optional(list(string), []) - ipv6_cidr_blocks = optional(list(string), []) - security_groups = optional(list(string), []) - prefix_list_ids = optional(list(string), []) - }), { - cidr_blocks = [] - ipv6_cidr_blocks = [] - security_groups = [] - prefix_list_ids = [] - }) - }), { - subnets = null - security_groups = null - ingress_sources = { - cidr_blocks = [] - ipv6_cidr_blocks = [] - security_groups = [] - prefix_list_ids = [] - } - }) - autoscaling = optional(object({ - max_capacity = optional(number, 5) - min_capacity = optional(number, 1) - memory_tracking_target_value = optional(number, 80) - cpu_tracking_target_value = optional(number, 80) - }), { - max_capacity = 5 - min_capacity = 1 - memory_tracking_target_value = 80 - cpu_tracking_target_value = 80 - }) - iam = optional(object({ - role = optional(object({ - name = optional(string, "fleet-role") - policy_name = optional(string, "fleet-iam-policy") - }), { - name = "fleet-role" - policy_name = "fleet-iam-policy" - }) - execution = optional(object({ - name = optional(string, "fleet-execution-role") - policy_name = optional(string, "fleet-execution-role") - }), { - name = "fleet-execution-role" - policy_name = "fleet-iam-policy-execution" - }) - }), { - name = "fleetdm-execution-role" - }) - software_installers = optional(object({ - create_bucket = optional(bool, true) - bucket_name = optional(string, null) - bucket_prefix = optional(string, "fleet-software-installers-") - s3_object_prefix = optional(string, "") - }), { - create_bucket = true - bucket_name = null - bucket_prefix = "fleet-software-installers-" - s3_object_prefix = "" - }) - }) - default = { - task_mem = null - task_cpu = null - mem = 512 - cpu = 256 - pid_mode = null - image = "fleetdm/fleet:v4.63.0" - family = "fleet" - sidecars = [] - depends_on = [] - volumes = [] - mount_points = [] - extra_environment_variables = {} - extra_iam_policies = [] - extra_execution_iam_policies = [] - extra_secrets = {} - security_groups = null - security_group_name = "fleet" - iam_role_arn = null - repository_credentials = "" - private_key_secret_name = "fleet-server-private-key" - service = { - name = "fleet" - } - database = { - password_secret_arn = null - user = null - database = null - address = null - rr_address = null - } - redis = { - address = null - use_tls = true - } - awslogs = { - name = null - region = null - create = true - prefix = "fleet" - retention = 5 - } - loadbalancer = { - arn = null - } - extra_load_balancers = [] - networking = { - subnets = null - security_groups = null - ingress_sources = { - cidr_blocks = [] - ipv6_cidr_blocks = [] - security_groups = [] - prefix_list_ids = [] - } - } - autoscaling = { - max_capacity = 5 - min_capacity = 1 - memory_tracking_target_value = 80 - cpu_tracking_target_value = 80 - } - iam = { - role = { - name = "fleet-role" - policy_name = "fleet-iam-policy" - } - execution = { - name = "fleet-execution-role" - policy_name = "fleet-iam-policy-execution" - } - } - software_installers = { - create_bucket = true - bucket_name = null - bucket_prefix = "fleet-software-installers-" - s3_object_prefix = "" - } - } - description = "The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified." - nullable = false -} - -variable "migration_config" { - type = object({ - mem = number - cpu = number - }) - default = { - mem = 2048 - cpu = 1024 - } - description = "The configuration object for Fleet's migration task." - nullable = false -} - -variable "alb_config" { - type = object({ - name = optional(string, "fleet") - subnets = list(string) - security_groups = optional(list(string), []) - access_logs = optional(map(string), {}) - certificate_arn = string - allowed_cidrs = optional(list(string), ["0.0.0.0/0"]) - allowed_ipv6_cidrs = optional(list(string), ["::/0"]) - egress_cidrs = optional(list(string), ["0.0.0.0/0"]) - egress_ipv6_cidrs = optional(list(string), ["::/0"]) - extra_target_groups = optional(any, []) - https_listener_rules = optional(any, []) - tls_policy = optional(string, "ELBSecurityPolicy-TLS-1-2-2017-01") - idle_timeout = optional(number, 905) - }) -} diff --git a/terraform/example/.header.md b/terraform/example/.header.md deleted file mode 100644 index 98148e667fed..000000000000 --- a/terraform/example/.header.md +++ /dev/null @@ -1,43 +0,0 @@ -# Fleet Terraform Module Example -This code provides some example usage of the Fleet Terraform module, including how some addons can be used to extend functionality. Prior to applying, edit the locals in `main.tf` to match the settings you want for your Fleet instance including: - - - domain name - - route53 zone name (may match the domain name) - - license key (if premium) - - uncommenting the mdm module if mdm is desired - - any extra settings to be passed to Fleet via ENV var. - -Due to Terraform issues, this code requires 3 applies "from scratch": -1. `terraform apply -target module.fleet.module.vpc` -2. `terraform apply -target module.osquery-carve -target module.firehose-logging` -3. If using a new route53 zone: - - `terraform apply -target aws_route53_zone.main` - - From the output, obtain the NS records created for the zone and add them to the parent DNS zone -4. If enabling mdm: `terraform apply -target module.mdm`. It will need to be uncommented as well as the KMS section below it. -5. `terraform apply -target module.fleet` -6. `terraform apply` -7. If enabling mdm do the following: - - Record the KMS key from step 5 output. - - Use `fleetctl` to obtain all of the mdm certs. Use https://fleetdm.com/docs/using-fleet/mdm-setup#apple-push-notification-service-apns and https://fleetdm.com/docs/using-fleet/mdm-setup#apple-business-manager-abm for reference. - - Place the certificates in the `resources` folder with the following names based upon their function: -``` -scep.crt -scep.key -apns.crt -apns.key -abm.crt -abm.key -abm_token.p7m -``` - - Using the `encrypt.sh` script, KMS encrypt all of these secrets as follows: -``` -cd resources -for i in *; do ../scripts/encrypt.sh $i $i.encrypted; done -for i in *.encrypted; do rm ${i/.encrypted/}; done -``` -This will encrypt all of the mdm secrets and add the .encrypted extension to them. It will also remove the non-encrypted version of the secrets so that they are encrypted at rest even locally. - - - Uncomment all of the resources and data sources in `mdm-secrets.tf`. - - Re-run `terraform apply` to populate the Secrets Manager secrets. - - Uncomment the sections in the `fleet_config` portion of `main.tf` for mdm and run a final `terraform apply`. Services will restart with mdm enabled. - diff --git a/terraform/example/.terraform-docs.yml b/terraform/example/.terraform-docs.yml deleted file mode 100644 index 1d139ddb401d..000000000000 --- a/terraform/example/.terraform-docs.yml +++ /dev/null @@ -1 +0,0 @@ -header-from: .header.md diff --git a/terraform/example/README.md b/terraform/example/README.md deleted file mode 100644 index d3d2fbc13b31..000000000000 --- a/terraform/example/README.md +++ /dev/null @@ -1,81 +0,0 @@ -# Fleet Terraform Module Example -This code provides some example usage of the Fleet Terraform module, including how some addons can be used to extend functionality. Prior to applying, edit the locals in `main.tf` to match the settings you want for your Fleet instance including: - - - domain name - - route53 zone name (may match the domain name) - - license key (if premium) - - uncommenting the mdm module if mdm is desired - - any extra settings to be passed to Fleet via ENV var. - -Due to Terraform issues, this code requires 3 applies "from scratch": -1. `terraform apply -target module.fleet.module.vpc` -2. `terraform apply -target module.osquery-carve -target module.firehose-logging` -3. If using a new route53 zone: - - `terraform apply -target aws_route53_zone.main` - - From the output, obtain the NS records created for the zone and add them to the parent DNS zone -4. If enabling mdm: `terraform apply -target module.mdm`. It will need to be uncommented as well as the KMS section below it. -5. `terraform apply -target module.fleet` -6. `terraform apply` -7. If enabling mdm do the following: - - Record the KMS key from step 5 output. - - Use `fleetctl` to obtain all of the mdm certs. Use https://fleetdm.com/docs/using-fleet/mdm-macos-setup#apple-push-notification-service-apns and https://fleetdm.com/docs/using-fleet/mdm-setup#apple-business-manager-abm for reference. - - Place the certificates in the `resources` folder with the following names based upon their function: -``` -scep.crt -scep.key -apns.crt -apns.key -abm.crt -abm.key -abm_token.p7m -``` - - Using the `encrypt.sh` script, KMS encrypt all of these secrets as follows: -``` -cd resources -for i in *; do ../scripts/encrypt.sh $i $i.encrypted; done -for i in *.encrypted; do rm ${i/.encrypted/}; done -``` -This will encrypt all of the mdm secrets and add the .encrypted extension to them. It will also remove the non-encrypted version of the secrets so that they are encrypted at rest even locally. - - - Uncomment all of the resources and data sources in `mdm-secrets.tf`. - - Re-run `terraform apply` to populate the Secrets Manager secrets. - - Uncomment the sections in the `fleet_config` portion of `main.tf` for mdm and run a final `terraform apply`. Services will restart with mdm enabled. - -## Requirements - -| Name | Version | -|------|---------| -| [aws](#requirement\_aws) | 5.36.0 | - -## Providers - -| Name | Version | -|------|---------| -| [aws](#provider\_aws) | 5.36.0 | - -## Modules - -| Name | Source | Version | -|------|--------|---------| -| [acm](#module\_acm) | terraform-aws-modules/acm/aws | 4.3.1 | -| [firehose-logging](#module\_firehose-logging) | github.com/fleetdm/fleet//terraform/addons/logging-destination-firehose | tf-mod-addon-logging-destination-firehose-v1.1.0 | -| [fleet](#module\_fleet) | github.com/fleetdm/fleet//terraform | tf-mod-root-v1.7.3 | -| [migrations](#module\_migrations) | github.com/fleetdm/fleet//terraform/addons/migrations | tf-mod-addon-migrations-v2.0.0 | -| [osquery-carve](#module\_osquery-carve) | github.com/fleetdm/fleet//terraform/addons/osquery-carve | tf-mod-addon-osquery-carve-v1.0.1 | - -## Resources - -| Name | Type | -|------|------| -| [aws_route53_record.main](https://registry.terraform.io/providers/hashicorp/aws/5.36.0/docs/resources/route53_record) | resource | -| [aws_route53_zone.main](https://registry.terraform.io/providers/hashicorp/aws/5.36.0/docs/resources/route53_zone) | resource | - -## Inputs - -No inputs. - -## Outputs - -| Name | Description | -|------|-------------| -| [route53\_name\_servers](#output\_route53\_name\_servers) | Ensure that these records are added to the parent DNS zone Delete this output if you switched the route53 zone above to a data source. | diff --git a/terraform/example/main.tf b/terraform/example/main.tf deleted file mode 100644 index 5fdcc9398b6b..000000000000 --- a/terraform/example/main.tf +++ /dev/null @@ -1,227 +0,0 @@ -# This example doesn't cover using a remote backend for storing the current -# terraform state in S3 with a lock in DynamoDB (ideal for AWS) or other -# methods. If using automation to apply the configuration or if multiple people -# will be managing these resources, this is recommended. -# -# See https://developer.hashicorp.com/terraform/language/settings/backends/s3 -# for reference. - -terraform { - required_providers { - aws = { - source = "hashicorp/aws" - version = "5.36.0" - } - } -} - -locals { - # Change these to match your environment. - domain_name = "fleet.example.com" - vpc_name = "fleet-vpc" - # This creates a subdomain in AWS to manage DNS Records. - # This allows for easy validation of TLS Certificates via ACM and - # the use of alias records to the load balancer. Please note if - # this is a subdomain that NS records will be needed to be created - # in the primary zone. These NS records will be included in the outputs - # of this terraform run. - zone_name = "fleet.example.com" - - # Bucket names need to be unique across AWS. Change this to a friendly - # name to make finding carves in s3 easier later. - osquery_carve_bucket_name = "fleet-osquery-carve" - osquery_results_bucket_name = "fleet-osquery-results" - osquery_status_bucket_name = "fleet-osquery-status" - - # Extra ENV Vars for Fleet customization can be set here. - fleet_environment_variables = { - # Uncomment and provide license key to unlock premium features. - # FLEET_LICENSE_KEY = "" - # JSON logging improves the experience with Cloudwatch Log Insights - FLEET_LOGGING_JSON = "true" - FLEET_MYSQL_MAX_OPEN_CONNS = "10" - FLEET_MYSQL_READ_REPLICA_MAX_OPEN_CONNS = "10" - # Vulnerabilities is a premium feature. - # Uncomment as this is a writable location in the container. - # FLEET_VULNERABILITIES_DATABASES_PATH = "/home/fleet" - FLEET_REDIS_MAX_OPEN_CONNS = "500" - FLEET_REDIS_MAX_IDLE_CONNS = "500" - } -} - -module "fleet" { - source = "github.com/fleetdm/fleet//terraform?ref=tf-mod-root-v1.11.1" - certificate_arn = module.acm.acm_certificate_arn - - vpc = { - # By default, Availabililty zones for us-east-2 are configured. If an alternative region is desired, - # configure the azs (3 required) variable below to the desired region. If you have an exported AWS-REGION or a - # region declared in ~/.aws/config, this value must match the region declared below. - name = local.vpc_name - # azs = ["ca-central-1a", "ca-central-1b", "ca-central-1d"] - } - - fleet_config = { - # To avoid pull-rate limiting from dockerhub, consider using our quay.io mirror - # for the Fleet image. e.g. "quay.io/fleetdm/fleet:v4.62.3" - image = "fleetdm/fleet:v4.62.3" # override default to deploy the image you desire - # See https://fleetdm.com/docs/deploy/reference-architectures#aws for appropriate scaling - # memory and cpu. - autoscaling = { - min_capacity = 2 - max_capacity = 5 - } - # 4GB Required for vulnerability scanning. 512MB works without. - mem = 4096 - cpu = 512 - extra_environment_variables = local.fleet_environment_variables - # Uncomment if enabling mdm module below. - # extra_secrets = module.mdm.extra_secrets - # extra_execution_iam_policies = module.mdm.extra_execution_iam_policies - extra_iam_policies = concat( - module.osquery-carve.fleet_extra_iam_policies, - module.firehose-logging.fleet_extra_iam_policies, - ) - } - rds_config = { - # See https://fleetdm.com/docs/deploy/reference-architectures#aws for instance classes. - instance_class = "db.t4g.medium" - # Prevents edge case render failure in Audit log on the home screen. - db_parameters = { - # 8mb up from 262144 (256k) default - sort_buffer_size = 8388608 - } - # Uncomment to specify the RDS engine version - # engine_version = "8.0.mysql_aurora.3.07.1" - } - redis_config = { - # See https://fleetdm.com/docs/deploy/reference-architectures#aws for instance types. - instance_type = "cache.t4g.small" - # Note these parameters help performance with large/complex live queries. - # See https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Troubleshooting-live-queries.md#1-redis for details. - parameter = [ - { name = "client-output-buffer-limit-pubsub-hard-limit", value = 0 }, - { name = "client-output-buffer-limit-pubsub-soft-limit", value = 0 }, - { name = "client-output-buffer-limit-pubsub-soft-seconds", value = 0 }, - ] - } - alb_config = { - # Script execution can run for up to 300s plus overhead. - # Ensure the load balancer does not 5XX before we have results. - idle_timeout = 905 - } -} - -# Migrations will handle scaling Fleet to 0 running containers before running the DB migration task. -# This module will also handle scaling back up once migrations complete. -# NOTE: This requires the aws cli to be installed on the device running terraform as terraform -# doesn't directly support all the features required. the aws cli is invoked via a null-resource. - -module "migrations" { - source = "github.com/fleetdm/fleet//terraform/addons/migrations?ref=tf-mod-addon-migrations-v2.0.1" - ecs_cluster = module.fleet.byo-vpc.byo-db.byo-ecs.service.cluster - task_definition = module.fleet.byo-vpc.byo-db.byo-ecs.task_definition.family - task_definition_revision = module.fleet.byo-vpc.byo-db.byo-ecs.task_definition.revision - subnets = module.fleet.byo-vpc.byo-db.byo-ecs.service.network_configuration[0].subnets - security_groups = module.fleet.byo-vpc.byo-db.byo-ecs.service.network_configuration[0].security_groups - ecs_service = module.fleet.byo-vpc.byo-db.byo-ecs.service.name - desired_count = module.fleet.byo-vpc.byo-db.byo-ecs.appautoscaling_target.min_capacity - min_capacity = module.fleet.byo-vpc.byo-db.byo-ecs.appautoscaling_target.min_capacity -} - -module "osquery-carve" { - # The carve bucket also stores software. - source = "github.com/fleetdm/fleet//terraform/addons/osquery-carve?ref=tf-mod-addon-osquery-carve-v1.1.0" - osquery_carve_s3_bucket = { - name = local.osquery_carve_bucket_name - } -} - -module "firehose-logging" { - source = "github.com/fleetdm/fleet//terraform/addons/logging-destination-firehose?ref=tf-mod-addon-logging-destination-firehose-v1.1.0" - osquery_results_s3_bucket = { - name = local.osquery_results_bucket_name - } - osquery_status_s3_bucket = { - name = local.osquery_status_bucket_name - } -} - -## MDM - -# MDM Secrets must be populated with JSON data including the payload from the certs, keys, challenge, etc. -# These can be populated via terraform with a secret-version, or manually after terraform is applied. -# Note: Services will not start if the mdm module is enabled and the secrets are applied but not populated. - - -## MDM Secret payload - -# See https://github.com/fleetdm/fleet/blob/tf-mod-addon-mdm-v2.0.0/terraform/addons/mdm/README.md#abm -# Per that document, both Windows and Mac will use the same SCEP secret under the hood. - - -# module "mdm" { -# source = "github.com/fleetdm/fleet//terraform/addons/mdm?ref=tf-mod-addon-mdm-v2.0.0" -# # Set apn_secret_name = null if not using mac mdm -# apn_secret_name = "fleet-apn" -# scep_secret_name = "fleet-scep" -# # Set abm_secret_name = null if customer is not using dep -# abm_secret_name = "fleet-dep" -# enable_apple_mdm = true -# enable_windows_mdm = true -# } - -# If you want to supply the MDM secrets via terraform, I recommend that you do not store the secrets in the clear -# on the device that applies the terraform. For the example here, terraform will create a KMS key, which will then -# be used to encrypt the secrets. The included mdm-secrets.tf file will then use the KMS key to dercrypt the secrets -# on the filesystem to generate the - -# resource "aws_kms_key" "fleet_data_key" { -# description = "key used to encrypt sensitive data stored in terraform" -# } -# -# resource "aws_kms_alias" "alias" { -# name = "alias/fleet-terraform-encrypted" -# target_key_id = aws_kms_key.fleet_data_key.id -# } -# -# output "kms_key_id" { -# value = aws_kms_key.fleet_data_key.id -# } - -module "acm" { - source = "terraform-aws-modules/acm/aws" - version = "4.3.1" - - domain_name = local.domain_name - # If you change the route53 zone to a data source this needs to become "data.aws_route53_zone.main.id" - zone_id = aws_route53_zone.main.id - - wait_for_validation = true -} - -# If you already are managing your zone in AWS in the same account, -# this resource could be swapped with a data source instead to -# read the properties of that resource. -resource "aws_route53_zone" "main" { - name = local.zone_name -} - -resource "aws_route53_record" "main" { - # If you change the route53_zone to a data source this also needs to become "data.aws_route53_zone.main.id" - zone_id = aws_route53_zone.main.id - name = local.domain_name - type = "A" - - alias { - name = module.fleet.byo-vpc.byo-db.alb.lb_dns_name - zone_id = module.fleet.byo-vpc.byo-db.alb.lb_zone_id - evaluate_target_health = true - } -} - -# Ensure that these records are added to the parent DNS zone -# Delete this output if you switched the route53 zone above to a data source. -output "route53_name_servers" { - value = aws_route53_zone.main.name_servers -} diff --git a/terraform/example/mdm-secrets.tf b/terraform/example/mdm-secrets.tf deleted file mode 100644 index 513aaab4199d..000000000000 --- a/terraform/example/mdm-secrets.tf +++ /dev/null @@ -1,124 +0,0 @@ -# Note: Everything is commented out here as mdm is not enabled by default. -# Uncomment to use. - -# This section expects all kms-encrypted secrets to live in the resources/ -# subdirectory. The list of expected filenames is as follows: - -locals { - mdm_resource_path = "${path.module}/resources" - scep_cert = "${local.mdm_resource_path}/scep.crt.encrypted" - scep_key = "${local.mdm_resource_path}/scep.key.encrypted" - apns_cert = "${local.mdm_resource_path}/apns.crt.encrypted" - apns_key = "${local.mdm_resource_path}/apns.key.encrypted" - abm_cert = "${local.mdm_resource_path}/abm.crt.encrypted" - abm_key = "${local.mdm_resource_path}/abm.key.encrypted" - abm_token = "${local.mdm_resource_path}/abm_token.p7m.encrypted" -} - -# To ease the process of encrypting and decrypting secrets, see -# scripts/encrypt.sh and scripts/decrypt.sh - -# Place your non-encrypted files in the resources folder and -# run the following: -# -# cd resources -# for i in *; do ../scripts/encrypt.sh $i $i.encrypted; done -# for i in *.encrypted; do rm ${i/.encrypted/}; done - -# The SCEP challenge will be randomly generated by terraform. We do not -# need to know what it is. For troubleshooting, it can always be found -# in the SCEP secret in AWS. - -# resource "random_password" "challenge" { -# length = 12 -# special = false -# } -# -# resource "aws_secretsmanager_secret_version" "scep" { -# secret_id = module.mdm.scep.id -# secret_string = jsonencode( -# { -# FLEET_MDM_APPLE_SCEP_CERT_BYTES = data.aws_kms_secrets.scep_cert.plaintext["FLEET_MDM_APPLE_SCEP_CERT_BYTES"] -# FLEET_MDM_APPLE_SCEP_KEY_BYTES = data.aws_kms_secrets.scep_key.plaintext["FLEET_MDM_APPLE_SCEP_KEY_BYTES"] -# FLEET_MDM_APPLE_SCEP_CHALLENGE = random_password.challenge.result -# } -# ) -# } -# -# -# data "aws_kms_secrets" "scep_cert" { -# secret { -# name = "FLEET_MDM_APPLE_SCEP_CERT_BYTES" -# key_id = aws_kms_key.fleet_data_key.id -# payload = file(local.scep_cert) -# } -# } -# -# data "aws_kms_secrets" "scep_key" { -# secret { -# name = "FLEET_MDM_APPLE_SCEP_KEY_BYTES" -# key_id = aws_kms_key.fleet_data_key.id -# payload = file(local.scep_key) -# } -# } -# -# resource "aws_secretsmanager_secret_version" "apn" { -# secret_id = module.mdm.apn.id -# secret_string = jsonencode( -# { -# FLEET_MDM_APPLE_APNS_CERT_BYTES = data.aws_kms_secrets.apns_cert.plaintext["FLEET_MDM_APPLE_APNS_CERT_BYTES"] -# FLEET_MDM_APPLE_APNS_KEY_BYTES = data.aws_kms_secrets.apns_key.plaintext["FLEET_MDM_APPLE_APNS_KEY_BYTES"] -# } -# ) -# } -# -# data "aws_kms_secrets" "apns_cert" { -# secret { -# name = "FLEET_MDM_APPLE_APNS_CERT_BYTES" -# key_id = aws_kms_key.fleet_data_key.id -# payload = file(local.apns_cert) -# } -# } -# -# data "aws_kms_secrets" "apns_key" { -# secret { -# name = "FLEET_MDM_APPLE_APNS_KEY_BYTES" -# key_id = aws_kms_key.fleet_data_key.id -# payload = file(local.apns_key) -# } -# } -# -# resource "aws_secretsmanager_secret_version" "abm" { -# secret_id = module.mdm.abm.id -# secret_string = jsonencode( -# { -# FLEET_MDM_APPLE_BM_CERT_BYTES = data.aws_kms_secrets.abm_cert.plaintext["FLEET_MDM_APPLE_BM_CERT_BYTES"] -# FLEET_MDM_APPLE_BM_KEY_BYTES = data.aws_kms_secrets.abm_key.plaintext["FLEET_MDM_APPLE_BM_KEY_BYTES"] -# FLEET_MDM_APPLE_BM_SERVER_TOKEN_BYTES = data.aws_kms_secrets.token.plaintext["FLEET_MDM_APPLE_BM_SERVER_TOKEN_BYTES"] -# } -# ) -# } -# -# data "aws_kms_secrets" "abm_cert" { -# secret { -# name = "FLEET_MDM_APPLE_BM_CERT_BYTES" -# key_id = aws_kms_key.fleet_data_key.id -# payload = file(local.abm_cert) -# } -# } -# -# data "aws_kms_secrets" "abm_key" { -# secret { -# name = "FLEET_MDM_APPLE_BM_KEY_BYTES" -# key_id = aws_kms_key.fleet_data_key.id -# payload = file(local.abm_key) -# } -# } -# -# data "aws_kms_secrets" "token" { -# secret { -# name = "FLEET_MDM_APPLE_BM_SERVER_TOKEN_BYTES" -# key_id = aws_kms_key.fleet_data_key.id -# payload = file(local.abm_token) -# } -# } diff --git a/terraform/example/scripts/decrypt.sh b/terraform/example/scripts/decrypt.sh deleted file mode 100755 index fe99095b7a34..000000000000 --- a/terraform/example/scripts/decrypt.sh +++ /dev/null @@ -1,27 +0,0 @@ -#!/bin/bash - -set -e - -function usage() { - cat <<-EOUSAGE - - Usage: $(basename ${0}) [AWS_PROFILE] - - This script decrypts an AWS KMS encrypted file from the desired - SOURCE and places it it as the DESTINATION file. Optionally you - may provide the AWS_PROFILE you wish to use to run the aws kms - commands. - - Hint: You can use /dev/stdout for the destination to just view the - output. - EOUSAGE - exit 1 -} - -[ $# -lt 3 ] && usage - -if [ -n "${4}" ]; then - export AWS_PROFILE=${4} -fi - -aws kms decrypt --key-id "${1:?}" --ciphertext-blob fileb://<(cat "${2:?}" | base64 -d) --output text --query Plaintext | base64 --decode > "${3:?}" diff --git a/terraform/example/scripts/encrypt.sh b/terraform/example/scripts/encrypt.sh deleted file mode 100755 index baf900bcc8c5..000000000000 --- a/terraform/example/scripts/encrypt.sh +++ /dev/null @@ -1,25 +0,0 @@ -#!/bin/bash - -set -e - -function usage() { - cat <<-EOUSAGE - - Usage: $(basename ${0}) [AWS_PROFILE] - - This script encrypts an plaintext file from SOURCE into an - AWS KMS encrypted DESTINATION file. Optionally you - may provide the AWS_PROFILE you wish to use to run the aws kms - commands. - - EOUSAGE - exit 1 -} - -[ $# -lt 3 ] && usage - -if [ -n "${4}" ]; then - export AWS_PROFILE=${4} -fi - -aws kms encrypt --key-id "${1:?}" --plaintext fileb://<(cat "${2:?}") --output text --query CiphertextBlob > "${3:?}" diff --git a/terraform/main.tf b/terraform/main.tf deleted file mode 100644 index 7c43593b8824..000000000000 --- a/terraform/main.tf +++ /dev/null @@ -1,59 +0,0 @@ -terraform { - required_version = ">= 1.3.8" -} - -module "vpc" { - source = "terraform-aws-modules/vpc/aws" - version = "5.1.2" - - name = var.vpc.name - cidr = var.vpc.cidr - - azs = var.vpc.azs - private_subnets = var.vpc.private_subnets - public_subnets = var.vpc.public_subnets - database_subnets = var.vpc.database_subnets - elasticache_subnets = var.vpc.elasticache_subnets - create_database_subnet_group = var.vpc.create_database_subnet_group - create_database_subnet_route_table = var.vpc.create_database_subnet_route_table - create_elasticache_subnet_group = var.vpc.create_elasticache_subnet_group - create_elasticache_subnet_route_table = var.vpc.create_elasticache_subnet_route_table - enable_vpn_gateway = var.vpc.enable_vpn_gateway - one_nat_gateway_per_az = var.vpc.one_nat_gateway_per_az - single_nat_gateway = var.vpc.single_nat_gateway - enable_nat_gateway = var.vpc.enable_nat_gateway - enable_flow_log = var.vpc.enable_flow_log - create_flow_log_cloudwatch_log_group = var.vpc.create_flow_log_cloudwatch_log_group - create_flow_log_cloudwatch_iam_role = var.vpc.create_flow_log_cloudwatch_iam_role - flow_log_max_aggregation_interval = var.vpc.flow_log_max_aggregation_interval - flow_log_cloudwatch_log_group_name_prefix = var.vpc.flow_log_cloudwatch_log_group_name_prefix - flow_log_cloudwatch_log_group_name_suffix = var.vpc.flow_log_cloudwatch_log_group_name_suffix - vpc_flow_log_tags = var.vpc.vpc_flow_log_tags - enable_dns_hostnames = var.vpc.enable_dns_hostnames - enable_dns_support = var.vpc.enable_dns_support -} - -module "byo-vpc" { - source = "./byo-vpc" - vpc_config = { - vpc_id = module.vpc.vpc_id - networking = { - subnets = module.vpc.private_subnets - } - } - rds_config = merge(var.rds_config, { - subnets = module.vpc.database_subnets - }) - redis_config = merge(var.redis_config, { - subnets = module.vpc.elasticache_subnets - allowed_cidrs = module.vpc.private_subnets_cidr_blocks - elasticache_subnet_group_name = module.vpc.elasticache_subnet_group_name - availability_zones = var.vpc.azs - }) - alb_config = merge(var.alb_config, { - subnets = module.vpc.public_subnets - certificate_arn = var.certificate_arn - }) - ecs_cluster = var.ecs_cluster - fleet_config = var.fleet_config -} diff --git a/terraform/outputs.tf b/terraform/outputs.tf deleted file mode 100644 index 0290e4ba98aa..000000000000 --- a/terraform/outputs.tf +++ /dev/null @@ -1,7 +0,0 @@ -output "byo-vpc" { - value = module.byo-vpc -} - -output "vpc" { - value = module.vpc -} \ No newline at end of file diff --git a/terraform/variables.tf b/terraform/variables.tf deleted file mode 100644 index 40bd6dbdad32..000000000000 --- a/terraform/variables.tf +++ /dev/null @@ -1,454 +0,0 @@ -variable "vpc" { - type = object({ - name = optional(string, "fleet") - cidr = optional(string, "10.10.0.0/16") - azs = optional(list(string), ["us-east-2a", "us-east-2b", "us-east-2c"]) - private_subnets = optional(list(string), ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"]) - public_subnets = optional(list(string), ["10.10.11.0/24", "10.10.12.0/24", "10.10.13.0/24"]) - database_subnets = optional(list(string), ["10.10.21.0/24", "10.10.22.0/24", "10.10.23.0/24"]) - elasticache_subnets = optional(list(string), ["10.10.31.0/24", "10.10.32.0/24", "10.10.33.0/24"]) - - create_database_subnet_group = optional(bool, false) - create_database_subnet_route_table = optional(bool, true) - create_elasticache_subnet_group = optional(bool, true) - create_elasticache_subnet_route_table = optional(bool, true) - enable_vpn_gateway = optional(bool, false) - one_nat_gateway_per_az = optional(bool, false) - single_nat_gateway = optional(bool, true) - enable_nat_gateway = optional(bool, true) - enable_dns_hostnames = optional(bool, false) - enable_dns_support = optional(bool, true) - enable_flow_log = optional(bool, false) - create_flow_log_cloudwatch_log_group = optional(bool, false) - create_flow_log_cloudwatch_iam_role = optional(bool, false) - flow_log_max_aggregation_interval = optional(number, 600) - flow_log_cloudwatch_log_group_name_prefix = optional(string, "/aws/vpc-flow-log/") - flow_log_cloudwatch_log_group_name_suffix = optional(string, "") - vpc_flow_log_tags = optional(map(string), {}) - }) - default = { - name = "fleet" - cidr = "10.10.0.0/16" - azs = ["us-east-2a", "us-east-2b", "us-east-2c"] - private_subnets = ["10.10.1.0/24", "10.10.2.0/24", "10.10.3.0/24"] - public_subnets = ["10.10.11.0/24", "10.10.12.0/24", "10.10.13.0/24"] - database_subnets = ["10.10.21.0/24", "10.10.22.0/24", "10.10.23.0/24"] - elasticache_subnets = ["10.10.31.0/24", "10.10.32.0/24", "10.10.33.0/24"] - - create_database_subnet_group = false - create_database_subnet_route_table = true - create_elasticache_subnet_group = true - create_elasticache_subnet_route_table = true - enable_vpn_gateway = false - one_nat_gateway_per_az = false - single_nat_gateway = true - enable_nat_gateway = true - enable_dns_hostnames = false - enable_dns_support = true - enable_flow_log = false - create_flow_log_cloudwatch_log_group = false - create_flow_log_cloudwatch_iam_role = false - flow_log_max_aggregation_interval = 600 - flow_log_cloudwatch_log_group_name_prefix = "/aws/vpc-flow-log/" - flow_log_cloudwatch_log_group_name_suffix = "" - vpc_flow_log_tags = {} - } -} - -variable "certificate_arn" { - type = string -} - -variable "rds_config" { - type = object({ - name = optional(string, "fleet") - engine_version = optional(string, "8.0.mysql_aurora.3.07.1") - instance_class = optional(string, "db.t4g.large") - subnets = optional(list(string), []) - allowed_security_groups = optional(list(string), []) - allowed_cidr_blocks = optional(list(string), []) - apply_immediately = optional(bool, true) - monitoring_interval = optional(number, 10) - db_parameter_group_name = optional(string) - db_parameters = optional(map(string), {}) - db_cluster_parameter_group_name = optional(string) - db_cluster_parameters = optional(map(string), {}) - enabled_cloudwatch_logs_exports = optional(list(string), []) - master_username = optional(string, "fleet") - snapshot_identifier = optional(string) - cluster_tags = optional(map(string), {}) - }) - default = { - name = "fleet" - engine_version = "8.0.mysql_aurora.3.07.1" - instance_class = "db.t4g.large" - subnets = [] - allowed_security_groups = [] - allowed_cidr_blocks = [] - apply_immediately = true - monitoring_interval = 10 - db_parameter_group_name = null - db_parameters = {} - db_cluster_parameter_group_name = null - db_cluster_parameters = {} - enabled_cloudwatch_logs_exports = [] - master_username = "fleet" - snapshot_identifier = null - cluster_tags = {} - } - description = "The config for the terraform-aws-modules/rds-aurora/aws module" - nullable = false -} - -variable "redis_config" { - type = object({ - name = optional(string, "fleet") - replication_group_id = optional(string) - elasticache_subnet_group_name = optional(string) - allowed_security_group_ids = optional(list(string), []) - subnets = optional(list(string)) - availability_zones = optional(list(string)) - cluster_size = optional(number, 3) - instance_type = optional(string, "cache.m5.large") - apply_immediately = optional(bool, true) - automatic_failover_enabled = optional(bool, false) - engine_version = optional(string, "6.x") - family = optional(string, "redis6.x") - at_rest_encryption_enabled = optional(bool, true) - transit_encryption_enabled = optional(bool, true) - parameter = optional(list(object({ - name = string - value = string - })), []) - log_delivery_configuration = optional(list(map(any)), []) - tags = optional(map(string), {}) - }) - default = { - name = "fleet" - replication_group_id = null - elasticache_subnet_group_name = null - allowed_security_group_ids = [] - subnets = null - availability_zones = null - cluster_size = 3 - instance_type = "cache.m5.large" - apply_immediately = true - automatic_failover_enabled = false - engine_version = "6.x" - family = "redis6.x" - at_rest_encryption_enabled = true - transit_encryption_enabled = true - parameter = [] - log_delivery_configuration = [] - tags = {} - } -} - -variable "ecs_cluster" { - type = object({ - autoscaling_capacity_providers = optional(any, {}) - cluster_configuration = optional(any, { - execute_command_configuration = { - logging = "OVERRIDE" - log_configuration = { - cloud_watch_log_group_name = "/aws/ecs/aws-ec2" - } - } - }) - cluster_name = optional(string, "fleet") - cluster_settings = optional(map(string), { - "name" : "containerInsights", - "value" : "enabled", - }) - create = optional(bool, true) - default_capacity_provider_use_fargate = optional(bool, true) - fargate_capacity_providers = optional(any, { - FARGATE = { - default_capacity_provider_strategy = { - weight = 100 - } - } - FARGATE_SPOT = { - default_capacity_provider_strategy = { - weight = 0 - } - } - }) - tags = optional(map(string)) - }) - default = { - autoscaling_capacity_providers = {} - cluster_configuration = { - execute_command_configuration = { - logging = "OVERRIDE" - log_configuration = { - cloud_watch_log_group_name = "/aws/ecs/aws-ec2" - } - } - } - cluster_name = "fleet" - cluster_settings = { - "name" : "containerInsights", - "value" : "enabled", - } - create = true - default_capacity_provider_use_fargate = true - fargate_capacity_providers = { - FARGATE = { - default_capacity_provider_strategy = { - weight = 100 - } - } - FARGATE_SPOT = { - default_capacity_provider_strategy = { - weight = 0 - } - } - } - tags = {} - } - description = "The config for the terraform-aws-modules/ecs/aws module" - nullable = false -} - -variable "fleet_config" { - type = object({ - task_mem = optional(number, null) - task_cpu = optional(number, null) - mem = optional(number, 4096) - cpu = optional(number, 512) - pid_mode = optional(string, null) - image = optional(string, "fleetdm/fleet:v4.63.0") - family = optional(string, "fleet") - sidecars = optional(list(any), []) - depends_on = optional(list(any), []) - mount_points = optional(list(any), []) - volumes = optional(list(any), []) - extra_environment_variables = optional(map(string), {}) - extra_iam_policies = optional(list(string), []) - extra_execution_iam_policies = optional(list(string), []) - extra_secrets = optional(map(string), {}) - security_group_name = optional(string, "fleet") - iam_role_arn = optional(string, null) - repository_credentials = optional(string, "") - private_key_secret_name = optional(string, "fleet-server-private-key") - service = optional(object({ - name = optional(string, "fleet") - }), { - name = "fleet" - }) - database = optional(object({ - password_secret_arn = string - user = string - database = string - address = string - rr_address = optional(string, null) - }), { - password_secret_arn = null - user = null - database = null - address = null - rr_address = null - }) - redis = optional(object({ - address = string - use_tls = optional(bool, true) - }), { - address = null - use_tls = true - }) - awslogs = optional(object({ - name = optional(string, null) - region = optional(string, null) - create = optional(bool, true) - prefix = optional(string, "fleet") - retention = optional(number, 5) - }), { - name = null - region = null - prefix = "fleet" - retention = 5 - }) - loadbalancer = optional(object({ - arn = string - }), { - arn = null - }) - extra_load_balancers = optional(list(any), []) - networking = optional(object({ - subnets = optional(list(string), null) - security_groups = optional(list(string), null) - ingress_sources = optional(object({ - cidr_blocks = optional(list(string), []) - ipv6_cidr_blocks = optional(list(string), []) - security_groups = optional(list(string), []) - prefix_list_ids = optional(list(string), []) - }), { - cidr_blocks = [] - ipv6_cidr_blocks = [] - security_groups = [] - prefix_list_ids = [] - }) - }), { - subnets = null - security_groups = null - ingress_sources = { - cidr_blocks = [] - ipv6_cidr_blocks = [] - security_groups = [] - prefix_list_ids = [] - } - }) - autoscaling = optional(object({ - max_capacity = optional(number, 5) - min_capacity = optional(number, 1) - memory_tracking_target_value = optional(number, 80) - cpu_tracking_target_value = optional(number, 80) - }), { - max_capacity = 5 - min_capacity = 1 - memory_tracking_target_value = 80 - cpu_tracking_target_value = 80 - }) - iam = optional(object({ - role = optional(object({ - name = optional(string, "fleet-role") - policy_name = optional(string, "fleet-iam-policy") - }), { - name = "fleet-role" - policy_name = "fleet-iam-policy" - }) - execution = optional(object({ - name = optional(string, "fleet-execution-role") - policy_name = optional(string, "fleet-execution-role") - }), { - name = "fleet-execution-role" - policy_name = "fleet-iam-policy-execution" - }) - }), { - name = "fleetdm-execution-role" - }) - software_installers = optional(object({ - create_bucket = optional(bool, true) - bucket_name = optional(string, null) - bucket_prefix = optional(string, "fleet-software-installers-") - s3_object_prefix = optional(string, "") - }), { - create_bucket = true - bucket_name = null - bucket_prefix = "fleet-software-installers-" - s3_object_prefix = "" - }) - }) - default = { - task_mem = null - task_cpu = null - mem = 512 - cpu = 256 - pid_mode = null - image = "fleetdm/fleet:v4.63.0" - family = "fleet" - sidecars = [] - depends_on = [] - volumes = [] - mount_points = [] - extra_environment_variables = {} - extra_iam_policies = [] - extra_execution_iam_policies = [] - extra_secrets = {} - security_groups = null - security_group_name = "fleet" - iam_role_arn = null - repository_credentials = "" - private_key_secret_name = "fleet-server-private-key" - service = { - name = "fleet" - } - database = { - password_secret_arn = null - user = null - database = null - address = null - rr_address = null - } - redis = { - address = null - use_tls = true - } - awslogs = { - name = null - region = null - create = true - prefix = "fleet" - retention = 5 - } - loadbalancer = { - arn = null - } - extra_load_balancers = [] - networking = { - subnets = null - security_groups = null - ingress_sources = { - cidr_blocks = [] - ipv6_cidr_blocks = [] - security_groups = [] - prefix_list_ids = [] - } - } - autoscaling = { - max_capacity = 5 - min_capacity = 1 - memory_tracking_target_value = 80 - cpu_tracking_target_value = 80 - } - iam = { - role = { - name = "fleet-role" - policy_name = "fleet-iam-policy" - } - execution = { - name = "fleet-execution-role" - policy_name = "fleet-iam-policy-execution" - } - } - software_installers = { - create_bucket = true - bucket_name = null - bucket_prefix = "fleet-software-installers-" - s3_object_prefix = "" - } - } - description = "The configuration object for Fleet itself. Fields that default to null will have their respective resources created if not specified." - nullable = false -} - -variable "migration_config" { - type = object({ - mem = number - cpu = number - }) - description = "The configuration object for Fleet's migration task." - nullable = false - default = { - mem = 2048 - cpu = 1024 - } -} - -variable "alb_config" { - type = object({ - name = optional(string, "fleet") - security_groups = optional(list(string), []) - access_logs = optional(map(string), {}) - allowed_cidrs = optional(list(string), ["0.0.0.0/0"]) - allowed_ipv6_cidrs = optional(list(string), ["::/0"]) - egress_cidrs = optional(list(string), ["0.0.0.0/0"]) - egress_ipv6_cidrs = optional(list(string), ["::/0"]) - extra_target_groups = optional(any, []) - https_listener_rules = optional(any, []) - tls_policy = optional(string, "ELBSecurityPolicy-TLS-1-2-2017-01") - idle_timeout = optional(number, 905) - }) - default = {} -}